The audit trail

Edition: Community and Enterprise

Every step of every request is an event in one audit log: who asked, what the checks found, who approved, what ran, how many rows changed. The log never holds a value, masked or not.

Append-only, and chained

flowchart LR
    E1["Event 41<br/>hash(40) + data"] --> E2["Event 42<br/>hash(41) + data"] --> E3["Event 43<br/>hash(42) + data"] --> E4["Checkpoint<br/>signed by the executor"]
    classDef ev fill:#E9EEF6,stroke:#23407A,color:#13202D
    classDef cp fill:#DCE3EE,stroke:#13202D,stroke-width:2px,color:#13202D
    class E1,E2,E3 ev
    class E4 cp

• Append-only. The web application's database account cannot update or delete an audit event. The database refuses it, whatever the code does.
• Hash-chained. Every event carries the hash of the one before it. Changing or deleting one breaks every hash after it, and verifying the chain names the first event where it breaks.
• Signed checkpoints. Every few minutes the executor signs the chain's size and head hash. Only the executor can sign one, so a compromised web application can add events but cannot forge a checkpoint. Checkpoints use the open C2SP signed-note format, so standard tools can verify them.

Proving it to someone else

The chain alone cannot show events removed from its end. A checkpoint kept outside sealfix can:

1. Send the audit events to your SIEM, or keep a recent checkpoint in a file sealfix cannot write.
2. Later, run sealfix audit verify --witness <file>. It reports a chain shorter than a checkpoint you kept, or a rewritten history.
3. With Git as the backend, every checkpoint is also committed to the repository, and sealfix audit verify --witness-git checks them all.

Where the events go

Destination	What arrives	Set up in
The audit log page	Every event, newest first, with chain verification	Built in
JSON lines export	The whole chain, one event per line, with each hash	Built in
Your SIEM	Every event as an OCSF 1.3 event over syslog with TLS	Integrations
Git	Templates, approvals, counts and checkpoints, as signed commits	Integrations