Audit & your SIEM¶
The audit trail¶
Audit trail records everything, hash-chained: every tool call with its arguments and result, what each person's AI was shown, failed sign-ins, and every change to guardrails, groups, identity, apps and tokens. Admins see the whole organization; everyone else sees their own.
- Filter by kind (tool calls, console and sign-in, failed sign-ins, tools shown, policy saves), by decision (allow, deny, approve, break_glass), by person, or by text.
- Click a row for the full payloads and hashes.
- Verify chain proves no row was changed or removed.
- Export downloads the trail.
Stream it to your SIEM¶
Your SIEM is the system of record; the console is for running Gate. Under Admin → Streaming, every audit row is sent as it is written to the destinations you add:
| Type | Format |
|---|---|
| Splunk HTTP Event Collector | JSON |
| Syslog over TLS, TCP or UDP | JSON or CEF |
| HTTPS webhook | JSON, signed with HMAC |
Adding a destination asks for your authenticator code, because a destination receives the whole trail, payloads included. Choose whether to include arguments and results, and keep Verify TLS certificate on.
What gets captured¶
Hashes of every argument set and result are always chained. Whether the payloads themselves are stored and streamed is up to you: Store the arguments of every call, Store what came back, and a result cap in bytes. Changing these is itself an audit event.
Pull instead of push¶
Collectors that poll can page the trail as NDJSON with a cursor:
curl -H "Authorization: Bearer $TOKEN" \
"https://<gate name>/api/v1/gate/audit/export?since_id=0&limit=5000"
For the next page, set since_id to the X-Gate-Next-Since-Id header of the last response.