Audit#
Hyvop writes one trail of what happened to a finding, a plan or a setting, and of who did it. The trail can be added to and never changed.
Governance > Audit log (/governance/audit). Administrators only; the menu entry is hidden from everyone else. It is
open in the Community Edition.
Reading the log#
Events are listed newest first, 50 to a page. Filter by event type, by the actor's e-mail, by subject, by resource, and by a time range.
Each event shows:
- who did it, and whether that was a signed-in person, an API key, the holder of a mailed link, or the system (a scheduled run);
- the actor's role;
- when, and from which address;
- the subject, the resource (linked), and the plan it belongs to;
- the state before and after, for a change.
On a plan (Remediation > Preview), administrators also get a Record panel: the events of that one remediation, oldest first, with a line for each thing a remediation ought to leave a record of, marked recorded or not recorded.
What is recorded#
| Area | Events |
|---|---|
| Findings | A finding first detected, with the detector that found it |
| Ownership | A person confirmed in a role on a resource, or withdrawn: the role, its kind, the evidence, and on whose word |
| Plans | A plan made, a plan written by the agent (the rulings, the approvers with their evidence, who drafted it), a plan edited (before and after) |
| Approval | Approval requested or reminded by e-mail; a step opened; a step escalated; a plan approved or rejected, by whom, as which role, with the comment, the address, and whether signed in or by mailed link |
| Policies | A policy saved (before and after) or deleted; a finding exempted by a policy and the end of the exemption; a plan forbidden by a policy; an approval refused because of one; an approver required by one |
| Accounts | Sign-in, and sign-in refused; a role changed; an account enabled, disabled or deleted |
| Settings | The mail relay changed or removed (never the password); the AI budget changed; the organisation's model changed, tested or removed (never the key); a detector's threshold changed |
| Integrations | An integration connected, changed, switched on or switched off: its settings before and after. Never a secret |
| Administrative requests | Every request that succeeded in changing something only an administrator may change: the method, the route and the answer. Never the body, which could hold a secret |
An event is written in the same transaction as the change it describes: both are kept or neither.
What is not recorded yet#
- The cloud call of a remediation, its result, and the state before and after. Nothing is carried out in this edition, so there is nothing to record.
- The conversation with the assistant. It is kept for a day in a cache and is not on the trail.
- Who started a detection run, beyond the detector that found the finding and the actor of the run.
How far to trust it#
- The trail is append-only in the database: a trigger refuses update, delete and truncate, for every database role, including the application's.
- The address recorded with an event is only as good as the proxies in front of core. The administrator must set
core.env.INTERNAL_PROXIES, or a caller on the private network can have an address of its choosing recorded.
Not in this edition: tamper evidence, retention rules and export to a SIEM. They belong to the finance-grade audit trail, which is Enterprise only (editions.md).