Audit log
The Audit log is the record of who changed your controls and incidents, and when. This page explains what is recorded, how to search and filter the log, and how to export it as a spreadsheet or as a signed, tamper-evident file for an auditor.
Who uses it
| Role | What they do here |
|---|---|
| Admin | Reads the log, exports it as CSV, and makes a signed export |
| Auditor, Policy editor and Incident responder | Read the log and export it as CSV |
Nobody can add, change or remove entries. Command writes them itself.
What is recorded
Command records these events automatically, with the person who did it and the time:
| Object | Events |
|---|---|
| Controls | Created, saved, published, unpublished and deleted, with the control's title |
| Incidents | Declared, with the severity, and resolved, with the incident's title. Opening an investigation is recorded as a declaration too. |
Changes to the implementation score are not recorded, because Command calculates the score itself. The stage changes, clocks and explanations of a case are recorded on that case's own timeline. See Incidents.
Read the log
Filter and search
When nothing matches, the log says No events match these filters.
Export the log
Export as CSV
Click Export CSV. Command downloads the file audit-log.csv and shows Exported {n} events to CSV.
The file contains the whole log, whatever filters you have set, with the time, actor, action, object type, object and summary of each event. Open it in any spreadsheet application.
Make a signed export
A signed export lets an auditor check that the log has not been changed after you exported it.
audit-log.signed.json, signed by Soveryne, and shows Signed, tamper-evident export generated.The same entries always produce the same signature, so any change to the exported file breaks it. An export made after more events were logged has a new signature.
How Command protects you
Troubleshooting
| What you see | What it means | What to do |
|---|---|---|
| Signed export failed: followed by a reason | The signed export could not be made, for example because your role is not Admin | Ask an Admin to make the signed export |
| No events match these filters. | No entry matches your filters or search | Set the filters back to All users, All objects and All events, and clear the search |
| An action you took is not in the log | Only the events listed above are recorded | Check the case timeline for incident details, or the control's version history for approvals |