Overview#
When a defence contractor's internal investigation reveals that sensitive personnel files were accessed outside normal working hours for three weeks before a data breach, the first question the security team asks is: who accessed what, and when? Without tamper-proof logs, that question may never be answerable. The Audit Trail and Compliance module ensures it always is, recording every system interaction with microsecond precision, cryptographic verification, and sub-second search across years of history.
The platform serves intelligence agencies, law enforcement, corporate security teams, financial institutions, and healthcare organisations operating under frameworks that demand complete audit visibility. Immutable logging, real-time compliance monitoring, AI-powered anomaly detection, and automated evidence collection support both day-to-day operations and formal regulatory examinations.
Key Features#
Immutable Audit Logging#
Cryptographically verified audit logs with tamper-proof storage prevent unauthorised modifications. Microsecond-precision event capture across all user actions, system operations, evidence handling, and administrative changes. Sub-second search across large-scale historical event archives, including organisation-level isolation for multi-tenant deployments.
Multi-Compliance Monitoring#
Real-time compliance monitoring and enforcement across CJIS, FedRAMP High, SOC 2 Type II, HIPAA, GDPR, ISO 27001, and NIST 800-53 frameworks. Automated control testing with pass/fail evidence generation, continuous deviation detection, and compliance violation alerts with recommended remediation actions.
Anomaly Detection and Insider Threat#
AI-powered User and Entity Behaviour Analytics (UEBA) with baseline behaviour profiling, peer group analysis, and predictive risk scoring. Detects unusual data access patterns, after-hours activity, geographic anomalies, and behaviour consistent with data exfiltration. Automated response workflows escalate from enhanced monitoring through account suspension based on risk severity.
Compliance Evidence Repository#
Centralised storage of all compliance artefacts: control evidence, audit artefacts, policies and procedures, training records, vendor compliance documentation, and incident reports. Automated evidence collection supports annual audits, regulatory examinations, and security assessments without manual compilation.
Compliance Dashboard and Reporting#
Real-time compliance posture visibility with executive summaries, control status tracking, and remediation management. Automated daily control testing, weekly metrics, monthly assessments, quarterly audits, and annual certification support. All reports are role-gated with organisation-level data isolation.
Use Cases#
- Law Enforcement Agencies: CJIS compliance with complete NCIC query logging, personnel security tracking, and incident response documentation.
- Federal Agencies: FedRAMP continuous monitoring with automated POA&M generation, vulnerability management, and 3PAO assessment support.
- Financial Institutions: SOC 2 Type II evidence collection, GDPR data subject rights workflows, and automated vendor compliance tracking.
- Healthcare Organisations: HIPAA PHI protection with minimum necessary standards, breach notification workflows, and security risk assessments.
Integration#
API access for custom event capture, compliance framework configuration, user monitoring policy management, and anomaly detection tuning. Integrates with existing SIEM, DLP, and security tools. Supports third-party attestation for SOC 2, FedRAMP, and ISO 27001 audits with ready-made evidence packages.
Open Standards#
- FIPS 180-4 / FIPS 202 (SHA-256, SHA-512, SHA3-256): Every audit event and evidence record is hashed using SHA-256 (primary), SHA-512, and SHA3-256 in a linked hash chain to guarantee tamper-evident immutability.
- ArcSight Common Event Format (CEF): The SIEM export service produces CEF-formatted log lines for ingestion into Splunk, Microsoft Sentinel, IBM QRadar, and compatible platforms.
- NENA i3 / NG911: A dedicated NG911 audit action vocabulary records all state-changing operations in Next Generation 9-1-1 workstreams using the NENA i3 event-type namespace.
- NIST SP 800-53: The multi-compliance monitoring engine continuously tests controls and generates pass/fail evidence against the NIST SP 800-53 control catalogue used by FedRAMP High authorisations.
- RFC 4122 (UUID): All audit events, custody chain entries, export operations, and filter records are identified by version-4 UUIDs conforming to RFC 4122.
- ISO 8601 / RFC 3339: Every event timestamp and retention boundary is serialised as a UTC-anchored ISO 8601 datetime string, ensuring interoperability with external SIEM and compliance tooling.
- RFC 2104 (HMAC): Hash-chain verification uses constant-time HMAC comparison to prevent timing-oracle attacks when validating stored versus computed event hashes.
- BLAKE2b (RFC 7693): Evidence integrity records carry a BLAKE2b digest alongside the SHA family hashes, providing a high-speed, collision-resistant alternative for cross-validation.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14