Audit log

The audit log answers who did what to which object and when. It lives in an append-only table, streams to your SIEM over syslog with TLS and is never deleted. Admins and auditors open it from Audit log in the Administration group of the sidebar.

Columns#

The log shows 25 entries a page, newest first, with the page controls under it.

Area icons#

Each Action cell opens with the icon of the area the action belongs to, the same icon that area carries in the sidebar. Hold the pointer over it for the area's name. An action outside these areas carries the Audit log icon.

The icon shows the area; the Evidence, Reports, Imports and Administration filters below group the same actions more broadly.

The hash chain#

In the example dataset the newest Entry cell reads #18,247 852d7dc9: the entry number, then the start of its hash. Hover over the cell to see both full hashes.

Entry 18247, sha256:<hash of this entry>, previous <hash of the entry before it>

The tooltip prints the entry number without a thousands separator. Hashes appear nowhere else on screen.

Verify the chain#

Select Verify chain. The button reads Verifying while Foxborne works. The note above the log reads Verifying with the number of entries, then Recomputing each hash from the entry and the hash before it.

When every entry matches, the console confirms Chain intact. Every entry matches. The green note returns with the new count and time.

Chain intact
18,247 entries verified, the latest at 09:44:02 UTC on 26 Sep. Entries also stream to your SIEM over syslog with TLS.

The check is itself recorded, as Verified audit chain on Audit log with a detail such as 18,019 entries intact. A missing or altered entry breaks the chain, which makes gaps and edits detectable.

Filter the log#

• The segmented control picks a category: All, Evidence, Reports, Imports or Administration.
• Filter by person, action or object matches those fields and the detail text. Type system to find automated entries.
• The count reads, for example, Showing 27 of 18,247. The second number is the newest entry number.
• The page address keeps both filters, such as /app/audit?kind=evidence&q=INC-0142, so a filtered view can be bookmarked.

The category follows the wording of the action. The tables below list every action under the category it files to.

Actions#

The Detail column shows a value from the example dataset, or the form the detail takes. Words in italics change from entry to entry.

Evidence#

Viewed evidence is written each time the evidence inspector or an event page opens, with the event's title as the detail.

Reports#

Edited report also carries details such as Sequence, added event ID and Resolved a question. Exported case file is written when the PDF case file is exported with no approval needed. Its detail adds ", stamped DRAFT" and ", coordinates removed" only when they apply.

Requested export is written when an export needs approval. Its detail names both approvers, as "Approvers:", when the export leaves the enclave. Export formats and evidence bundles sets out when each applies.

When the Generic webhook (HMAC) has egress on, Changed status also sends a case.status_changed event. When Jira Data Center has egress on and the incident has an issue, it also comments on that issue.

Imports#

A run imported by hand reads, for example, 1 file, manual upload.

Administration#

Sources and collectors

Rules

Hosting

Access and sign-in

Audit log and settings

Integrations

Alerts and automations

Changed alert rule lists only the parts that changed. With every part changed, it reads condition, severity and routing, destinations. In the example dataset, one admin configured and tested each destination, and a second admin turned on its egress.

Export the audit log#

Select Export. The Export the audit log dialog notes The export includes each entry’s hash and the hash before it, so it can be verified offline.

Select Export. The console confirms Audit log exported with hashes, and the export is itself recorded as Exported audit log with the detail Hashes included.

Each exported entry carries its own hash and the one before it. A reviewer holding the file can check the chain away from the deployment.

Stream to your SIEM#

When the Syslog over TLS destination has egress on, Foxborne forwards each entry as it is written, one syslog message per entry. Each message carries the entry's marking, number, time, person, action, object and detail, with its hash and the prev hash before it.

The Hosting page lists the stream under Outbound connections as Your SIEM, for example "Audit log and delivery ledger, syslog over TLS to logs.soc.hfr.internal:6514. Data class L1." The Delivery ledger tab of Integrations lists each forwarded entry under Audit stream, such as Audit entry 18,247, Viewed evidence.

Forward logs to your SIEM covers the setup and the message format.

Storage and retention#

Related#

• Roles and permissions shows who holds Read the audit log.
• Encryption and keys covers the key that encrypts the log.
• Security model places the log among the other controls.