Overview#
The Audit Trail and Compliance module records every system interaction in a tamper-evident, append-only audit trail with cryptographic verification, real-time compliance monitoring, and automated evidence collection across major regulatory frameworks.
When an internal investigation reveals that sensitive personnel files were accessed outside normal working hours in the weeks before a data breach, the first question the security team asks is: who accessed what, and when? Without tamper-evident logs, that question may never be answerable. This module makes it answerable, capturing each interaction as it happens and keeping the record searchable, and unalterable, for years.
The platform serves intelligence agencies, law enforcement, corporate security teams, financial institutions, and healthcare organisations operating under frameworks that demand complete audit visibility. Immutable logging, real-time compliance monitoring, AI-powered anomaly detection, and automated evidence collection support both day-to-day operations and formal regulatory examinations.
Key Features#
Immutable Audit Logging#
Cryptographically verified audit logs with append-only storage enforced at the database layer: audit events can be added but never edited or deleted, even by administrators. Immutable event streams are tenant-scoped on write, and resource-access logging validates its inputs so callers cannot forge or inject fabricated audit entries. Microsecond-precision event capture spans all user actions, system operations, evidence handling, and administrative changes, including creation, update, and deletion of tracked location entities. Sub-second search across large-scale historical event archives, with organisation-level isolation for multi-tenant deployments.
Fail-Closed Access and Export Auditing#
Evidence access and export auditing is fail-closed: if the audit record cannot be written, the read or download does not happen. Evidence list access refuses to return results when its audit write fails, and evidence export downloads refuse to serve content unless the download event is recorded first. Oversight reviews can rely on the audit log being complete, because no export happens without a record.
Classification-Accurate Audit Records#
Audit records carry the true classification of the data each event touches rather than a default. Export-generated audit entries inherit the highest classification found in the exported content, with derivation that handles alias names, numeric ranks, and nested content, so classified export activity is filterable in the audit trail by its real secrecy level. Reference-data audit records likewise reflect the actual classification of the underlying record.
Multi-Compliance Monitoring#
Real-time compliance monitoring and enforcement across CJIS, FedRAMP High, SOC 2 Type II, HIPAA, GDPR, ISO 27001, and NIST 800-53 frameworks. Automated control testing with pass/fail evidence generation, continuous deviation detection, and compliance violation alerts with recommended remediation actions.
Anomaly Detection and Insider Threat#
AI-powered User and Entity Behaviour Analytics (UEBA) with baseline behaviour profiling, peer group analysis, and predictive risk scoring. Detects unusual data access patterns, after-hours activity, geographic anomalies, and behaviour consistent with data exfiltration. Automated response workflows escalate from enhanced monitoring through account suspension based on risk severity.
Compliance Evidence Repository#
Centralised storage of all compliance artefacts: control evidence, audit artefacts, policies and procedures, training records, vendor compliance documentation, and incident reports. Automated evidence collection supports annual audits, regulatory examinations, and security assessments without manual compilation.
Compliance Dashboard and Reporting#
Real-time compliance posture visibility with executive summaries, control status tracking, and remediation management. Automated daily control testing, weekly metrics, monthly assessments, quarterly audits, and annual certification support. All reports are role-gated with organisation-level data isolation.
Use Cases#
- Law Enforcement Agencies: CJIS compliance with complete NCIC query logging, personnel security tracking, and incident response documentation.
- Federal Agencies: FedRAMP continuous monitoring with automated POA&M generation, vulnerability management, and 3PAO assessment support.
- Financial Institutions: SOC 2 Type II evidence collection, GDPR data subject rights workflows, and automated vendor compliance tracking.
- Healthcare Organisations: HIPAA PHI protection with minimum necessary standards, breach notification workflows, and security risk assessments.
Integration#
Programmatic access for custom event capture, compliance framework configuration, user monitoring policy management, and anomaly detection tuning. Integrates with existing SIEM, DLP, and security tools. Supports third-party attestation for SOC 2, FedRAMP, and ISO 27001 audits with ready-made evidence packages.
Open Standards#
- FIPS 180-4 / FIPS 202 (SHA-256, SHA-512, SHA3-256): Every audit event and evidence record is hashed using SHA-256 (primary), SHA-512, and SHA3-256 in a linked hash chain to guarantee tamper-evident immutability.
- ArcSight Common Event Format (CEF): The SIEM export service produces CEF-formatted log lines for ingestion into Splunk, Microsoft Sentinel, IBM QRadar, and compatible platforms.
- NENA i3 / NG911: A dedicated NG911 audit action vocabulary records all state-changing operations in Next Generation 9-1-1 workstreams using the NENA i3 event-type namespace.
- NIST SP 800-53: The multi-compliance monitoring engine continuously tests controls and generates pass/fail evidence against the NIST SP 800-53 control catalogue used by FedRAMP High authorisations.
- RFC 4122 (UUID): All audit events, custody chain entries, export operations, and filter records are identified by version-4 UUIDs conforming to RFC 4122.
- ISO 8601 / RFC 3339: Every event timestamp and retention boundary is serialised as a UTC-anchored ISO 8601 datetime string, ensuring interoperability with external SIEM and compliance tooling.
- RFC 2104 (HMAC): Hash-chain verification uses constant-time HMAC comparison to prevent timing-oracle attacks when validating stored versus computed event hashes.
- BLAKE2b (RFC 7693): Evidence integrity records carry a BLAKE2b digest alongside the SHA family hashes, providing a high-speed, collision-resistant alternative for cross-validation.
Last Reviewed: 2026-07-16 Last Updated: 2026-07-16