Audit & SIEM export

A record of every decision that no one can quietly change

Every security event goes through one writer into one trail, chained by SHA-256. Export it to your SIEM as CEF, OCSF-aligned JSON or JSON lines, keep it as long as you need, and erase people when they ask.

Book a demo Export formats

Security auditChain intact

Sign-in approved on phone[time]prev 9f3a…c21 · this 4be0…7d9

Role granted: Refund approver[time]prev 4be0…7d9 · this a17c…02e

Agent used an API key at its granted host[time]prev a17c…02e · this 61d8…b4f

Export CEFExport OCSFExport JSON lines

Why it matters

Answer the auditor in an afternoon

Edits and gaps show

Each row carries the hash of the one before it, so a changed or missing record breaks the chain.

Straight into your SIEM

CEF and OCSF are the formats security collectors already ingest.

Safe to share

Passwords, codes and keys are redacted before a record is written.

How it works

From event to SIEM

1Any doorAn event happensA sign-in, a grant, a role change, a billing change, an agent's use of a key.
2One writerRedactSecret-shaped fields become [REDACTED]; card numbers are masked.
3One writerChainsha256(previous hash + the canonical row), with a contiguous sequence number.
4OperatorVerifyThe chain check reports edits, gaps and relinking.
5Your SIEMPull with a cursorCEF, OCSF or JSON lines, 1,000 rows a call by default, 5,000 at most.

Formats and controls

What leaves, and how

Format or control	Details	Status
CEF	Revision 25. Severity 9 critical, 7 failed or denied, 3 otherwise. Vendor Marktine, product Identity Studio.	Live
OCSF 1.5.0	IAM category: Authentication (3002), Authorize Session (3003), Account Change (3001), Entity Management (3004). Aligned with required attributes; not certified.	Live
JSON lines	One event a line, with a keyset cursor in X-Next-Cursor.	Live
App-level export	JSON or CSV through the SDK, scoped to your application.	Live
Customer-visible log	Each organization sees its own rows; org admins see their members.	Live
Access reviews	Keep or revoke decisions; nobody reviews their own access; every decision recorded.	Live
Data export and erasure	Export a person's data, or anonymise them everywhere through one path, with a record that it was done.	Live
Retention	Horizons of 90 days for logs and 365 for audit, purged on schedule after a fresh backup checkpoint.	Early access

Not offered today: push forwarding to syslog or HTTP collectors; exports are pulled.

Configuration

Settings

Option	Values	Default
format	cef, ocsf, jsonl	jsonl
limit	Rows per call, up to 5,000	1,000
log_retention_days	How long logs are kept	90
audit_retention_days	How long the audit trail is kept	365

Under the hood

What protects it

From the code

services/siem_export.pya CEF line, as built

header = "|".join((
    "CEF:0", _VENDOR, _PRODUCT,
    version or product_version(),
    name, name, _severity(row),
))
ext_pairs = [
    ("rt", _epoch_ms(row.get("occurred_at"))),
    ("cat", row.get("event_category")),
    ("outcome", row.get("result")),
    ("src", row.get("source_ip")),
    ("suser", row.get("actor_principal_id") ...),
    ("duser", row.get("target_user_id") ...),
]

Security notes

Every export writes its own audit row.
People are pseudonymised in the trail; erasure anonymises rather than deleting rows.
Under heavy write contention a row can be written unchained; the chain check counts these.
Chain verification is run by the platform operator; customers read their own rows.

Works with

Part of one platform

Conditional access & risk Every allow, block and challenge.AI agents & MCP Every agent grant and use.Roles & permissions Reviews with a sign-off.API security Every key issued or rotated.

Which plans include it, and the limits that apply, are on the plans page.See plans →

Explore the platform

One platform, every piece of sign-in and access

Give your auditors a trail they can trust

Connect your SIEM and pull your first CEF export today.

Book a demo Start free trial