Audit log and the auditor evidence pack

Devexana keeps two hash-chained logs on the appliance: the audit log and the egress log. Auditors view and export both logs in Settings › Trust. They also download the evidence pack there.

Who can see the logs

The Auditor role and the Full access role can view, verify and export the audit log and the egress log. The Auditor role cannot read other data (Accounts, roles and sign-in).

Where the logs are

How the chain works

Each record stores a SHA-256 hash of its own content and the previous record. Database triggers reject updates and deletions of stored records. At start-up, the appliance recomputes the chain. Without the operating-system override, it refuses to start if the chain is broken.

The table shows three example records with shortened hashes.

Read down the table. Each record's previous hash matches the record hash of the record above it. The signed checkpoint covers the chain head. Keep the evidence pack outside the appliance.

The full description of the chain is on The audit log.

Verify the chain

The appliance recomputes every hash and identifies the first record with a hash mismatch.

1. Open Settings › Trust › Access audit.
2. Select Generate evidence pack.
3. Read the chain status in the summary. It shows "chain verified" or "CHAIN BROKEN".
4. If the status is "CHAIN BROKEN", open the audit integrity section of the downloaded file.

The audit integrity section identifies the first record with a hash mismatch.

The egress guard self-test in Settings › Trust › Egress log also verifies both chains. Its result shows the current chain head of the audit log.

Export the logs

To export a log as CSV, do these steps:

1. Open Settings › Trust › Access audit or Settings › Trust › Egress log.
2. Set the filters.
3. Set the date range.
4. Select Export CSV.

Devexana can also forward its own audit events to a SIEM as CEF or JSON over syslog or HTTP. This is off by default. Devexana does not read data from a SIEM.

The evidence pack

Auditors can download one evidence pack with the role matrix, access grants, an OSCAL package and the audit-chain integrity result. The pack is one JSON file. Devexana assembles it on the appliance.

The appliance records each evidence-pack download in the audit log.

Editions

OSCAL export and scheduled audit reports have their own screens only in the Business edition, under Insights. In the Government/Education edition, the OSCAL package is in the evidence pack. Edition differences are on Editions.

Keep a copy outside the appliance

Keep scheduled copies of the evidence pack outside the appliance. These files preserve earlier chain heads.

1. Generate the evidence pack on a fixed schedule, for example each week.
2. Store each file on a system that the appliance administrators cannot change.

Different chain heads alone do not establish whether someone changed earlier records.

Retention

Devexana does not delete audit records. The appliance records and refuses requests to delete audit records. The logs grow for the life of the appliance. Retention defaults for other data are on Data retention defaults.