Audit Logging
Beak maintains a comprehensive, tamper-proof audit trail across all product pillars. Every user action, system event, and data access is logged with full context for compliance and forensic purposes.
What is Logged
User Actions
| Category | Logged Events |
|---|---|
| Authentication | Login, logout, failed attempts, MFA events, SSO events, session creation/expiry |
| User Management | User creation, role changes, deactivation, permission modifications |
| Configuration | Settings changes, policy updates, integration modifications |
| Data Operations | Record creation, updates, deletions, exports, bulk operations |
Product-Specific Events
| Product | Key Audit Events |
|---|---|
| BEAK ITAM | Asset discovery runs, inventory changes, script executions, remote sessions |
| Beak Governance | License policy changes, cost alert modifications, AI gateway route changes |
| Beak Security | Scan initiations, patch deployments, policy enforcement, guardrail triggers |
| Beak Observability | Alert rule changes, dashboard modifications, trace access |
| Beak Desk | Ticket operations, SLA changes, routing rule updates, escalations |
| AI Studio | Agent deployments, data source changes, skill modifications, agent executions |
System Events
- API requests (method, endpoint, response code, latency)
- Background job executions
- Integration sync events
- Error and exception events
Audit Log Format
Each audit log entry includes:
| Field | Description |
|---|---|
| Timestamp | UTC timestamp with millisecond precision |
| Event ID | Unique identifier for the event |
| Actor | User ID, username, and IP address |
| Action | Action performed (CREATE, READ, UPDATE, DELETE, EXECUTE) |
| Resource | Resource type and identifier |
| Product | Which Beak product the action occurred in |
| Tenant | Tenant identifier |
| Details | Action-specific details (before/after values for updates) |
| Result | Success or failure with error details |
Viewing Audit Logs
Search & Filter
- Navigate to Audit Log
- Use filters to narrow results:
- Date Range — Select start and end dates
- User — Filter by specific user
- Product — Filter by Beak product pillar
- Action Type — CREATE, READ, UPDATE, DELETE, EXECUTE
- Resource Type — Assets, tickets, agents, policies, etc.
- Result — Success or failure
- Use full-text search across event details
Real-Time Stream
View audit events in real-time:
- Navigate to Audit Log > Live Stream
- Events appear as they occur across the platform
- Apply filters to focus on specific event types
Log Retention
Retention Policies
| Tier | Default Retention | Configurable |
|---|---|---|
| Standard | 1 year | Up to 2 years |
| Enterprise | 2 years | Up to 7 years |
| Compliance | 7 years | Up to 10 years |
Configure retention under Audit Log > Retention Settings.
Archival
Logs exceeding the active retention period are archived to cold storage (S3/Azure Blob) in compressed, encrypted format. Archived logs can be restored on demand for audit purposes.
Tamper-Proof Logging
Beak audit logs are designed to be tamper-proof:
- Immutability — Log entries cannot be modified or deleted by any user, including Super Admins
- Integrity Hashing — Each log entry includes a cryptographic hash chain linking it to the previous entry
- Separate Storage — Audit logs are stored in a dedicated, isolated data store
- Access Logging — Access to the audit log itself is audited
Export & Integration
Export Formats
Export audit logs for external analysis or compliance evidence:
- CSV — Spreadsheet-compatible format
- JSON — Structured data format for programmatic analysis
- PDF — Formatted reports for audit submission
SIEM Integration
Forward audit logs to external SIEM systems:
- Syslog — Standard syslog forwarding (RFC 5424)
- Webhook — HTTP POST to custom endpoints
- API — Pull audit logs via the REST API with pagination
Configure SIEM forwarding under Audit Log > Forwarding.
Related
- Compliance Frameworks — How audit logging satisfies framework requirements
- Data Privacy — Privacy controls for logged data