Skip to main content

​
Audit Log

CHAD maintains a complete audit trail of all user actions. This supports compliance requirements and helps investigate incidents.

​
What’s Logged

Every significant action is recorded:

​
User Actions

ActionDescription
user.loginUser logged in
user.logoutUser logged out
user.createUser account created
user.updateUser account modified
user.deleteUser account deleted
user.password_changePassword changed
user.2fa_enabled2FA activated
user.2fa_disabled2FA deactivated

​
Rule Actions

ActionDescription
rule.createRule created
rule.updateRule modified
rule.deleteRule deleted
rule.deployRule deployed
rule.undeployRule undeployed
rule.snoozeRule snoozed
rule.unsnoozeRule unsnoozed

​
Alert Actions

ActionDescription
alert.acknowledgeAlert acknowledged
alert.resolveAlert resolved
alert.false_positiveMarked false positive
alert.commentComment added

​
Configuration Actions

ActionDescription
settings.updateSettings modified
index_pattern.createIndex pattern created
index_pattern.updateIndex pattern modified
index_pattern.deleteIndex pattern deleted
exception.createException rule created
exception.deleteException rule deleted

​
Viewing Audit Logs

Navigate to Audit Log in the sidebar.

​
Filters

Filter by:
FilterOptions
Time rangeLast hour, day, week, custom
UserSpecific user
ActionAction type
ResourceResource type
Full-text search across:
  • Action descriptions
  • Resource names
  • User details
  • Changed values

​
Export

Export for compliance:
  1. Apply filters
  2. Click Export
  3. Choose format (CSV, JSON)
  4. Download

​
Audit Entry Details

Each entry includes:
FieldDescription
TimestampWhen the action occurred
UserWho performed the action
ActionWhat was done
ResourceWhat was affected
Resource IDUnique identifier
IP AddressUser’s IP address
DetailsBefore/after values

​
Example Entry

{
  "timestamp": "2024-01-15T14:32:17Z",
  "user": "admin@example.com",
  "action": "rule.deploy",
  "resource_type": "rule",
  "resource_id": "abc-123",
  "ip_address": "192.168.1.100",
  "details": {
    "rule_title": "Failed Login Attempt",
    "previous_status": "undeployed",
    "new_status": "deployed"
  }
}

​
Storage

​
PostgreSQL

Primary storage for audit logs:
  • Queryable via UI
  • Retained based on configuration
  • Used for compliance exports

​
OpenSearch (Optional)

Secondary storage for search:
  • Full-text search capabilities
  • Longer retention possible
  • Index: chad-audit
Enable in Settings > Audit.

​
Retention

Configure retention in Settings > Audit:
SettingDefaultDescription
PostgreSQL retention90 daysDays to keep in database
OpenSearch retention365 daysDays to keep in search index
Deleting audit logs may violate compliance requirements. Check your policies before reducing retention.

​
Compliance Use Cases

​
SOC 2

Demonstrate:
  • Access control enforcement
  • Change management
  • Monitoring capabilities
Export audit logs for auditors.

​
PCI DSS

Show:
  • User activity tracking
  • Configuration change logs
  • Access to sensitive data

​
HIPAA

Document:
  • Who accessed what, when
  • Configuration changes
  • Security event responses

​
Investigation Use Cases

​
Unauthorized Changes

  1. Filter by resource type
  2. Find unexpected changes
  3. Identify responsible user
  4. Review IP addresses

​
Incident Response

  1. Filter by time range
  2. See all actions during incident
  3. Correlate with security alerts
  4. Document timeline

​
Access Review

  1. Filter by user
  2. Review all their actions
  3. Verify appropriate access
  4. Document review

​
Best Practices

Balance storage costs with compliance requirements.
Periodic audit log review catches unauthorized activity.
Maintain offline copies for audit periods.
Audit logs should be tamper-evident and access-controlled.
Unusual admin activity may indicate compromise.

​
Troubleshooting

​
Logs not appearing

  1. Check action is auditable
  2. Verify user session is valid
  3. Check database connectivity
  4. Review error logs

​
Search not working

  1. Verify OpenSearch audit is enabled
  2. Check index exists
  3. Review field mappings

​
Export fails

  1. Reduce time range
  2. Check disk space
  3. Try smaller batch

​
Next Steps

User Management

Manage user access

Health Monitoring

Monitor system health