Audit Trail

This guide covers the immutable audit trail in the TealTiger Playground — what gets logged, how to filter and search events, how to export audit data for compliance, and practical examples for common audit scenarios.

Audit trail features require authentication and a team workspace. See the Getting Started Guide for setup.

Overview

The audit trail is an append-only, immutable log of every significant action in your workspace. Events cannot be modified or deleted — this guarantees a complete, tamper-evident history for compliance audits and security investigations. Every audit event includes:

Field	Description
`id`	Unique event identifier (UUID)
`workspaceId`	Workspace where the event occurred
`actorId`	User who performed the action
`action`	Event type (e.g., `policy_created`, `member_added`)
`resourceType`	Type of resource affected
`resourceId`	ID of the affected resource
`metadata`	Additional context (policy name, version, reason, etc.)
`createdAt`	Timestamp of the event

Audit Event Types

The audit trail captures 14 event types across five categories.

Policy Operations

Action	Description	Metadata
`policy_created`	A new policy was created	`policyName`
`policy_updated`	A policy was updated (new version saved)	`policyName`, `version`
`policy_deleted`	A policy was deleted	`policyName`
`policy_deployed`	A policy was deployed to an environment	`policyName`, `environment`
`policy_evaluated`	A policy was evaluated against a scenario	`policyName`, `decision`

Approval Actions

Action	Description	Metadata
`policy_approved`	An approver approved a policy version	`policyName`
`policy_rejected`	An approver rejected a policy version	`policyName`, `reason`

Membership Changes

Action	Description	Metadata
`member_added`	A user was added to the workspace	`username`, `role`
`member_removed`	A user was removed	`username`
`member_role_changed`	A user’s role was changed	`username`, `oldRole`, `newRole`

Authentication and Security

Action	Description
`auth_login`	A user signed in
`auth_logout`	A user signed out
`emergency_bypass`	A policy skipped the approval workflow

Filtering and Search

The Audit Filter Bar lets you narrow down events using four filter dimensions (combined with AND logic):

Date Range — Last 30/90/365 days or custom range
Actor — Filter by workspace member
Action Type — Select one or more action types
Resource Type — Narrow to policy, workspace_member, etc.

Exporting Audit Data

Export in three formats:

Format	Best For
CSV	Spreadsheet analysis, GRC platform import
JSON	Programmatic analysis, external tool integration
PDF	Sharing with auditors and stakeholders

How to Export

Open the Audit Trail → apply filters
Click “Export” → select format
The file downloads to your browser

Filters carry over to the export — what you see is what you get.

Tamper Detection

Every export includes a SHA-256 digital signature for tamper detection.

const exportData = await auditTrailService.exportJSON(workspaceId, filters);
const signature = await auditTrailService.signExport(exportData);

// Later, verify integrity
const isValid = await auditTrailService.verifySignature(exportData, signature);

Sensitive Data Redaction

The audit trail automatically redacts sensitive information before storing events:

Category	Patterns Detected	Replacement
API keys and tokens	`apiKey`, `token`, `accessToken`	`[REDACTED]`
Passwords and secrets	`password`, `secret`, `privateKey`	`[REDACTED]`
Email addresses	`[email protected]` patterns	`[EMAIL_REDACTED]`
Phone numbers	`555-123-4567` patterns	`[PHONE_REDACTED]`

Redaction happens at write time — sensitive data never reaches the database.

Compliance Use Cases

SOC2 Type II — Access Controls

Filter by member_added, member_removed, member_role_changed → Export as PDF for the audit period. Filter by policy_evaluated → Export as JSON for your data processing register.

OWASP ASI — Security Event Monitoring

Filter by emergency_bypass and policy_deployed to track production changes.

ISO 27001 — Change Management Evidence

Filter by policy_created, policy_updated, policy_deleted → Export as CSV for your ISMS.

Best Practices

Export monthly — maintain a regular cadence of signed JSON exports
Always sign exports — the SHA-256 signature proves data integrity
Apply filters before exporting — export only what’s needed
Map audit events to framework controls using the Compliance Mapping guide
Keep exports for your retention period — most frameworks require 1–7 years

Getting Started — Sign in, create workspaces, write your first policy
Governance Workflow — Approval processes, emergency bypass, impact analysis
Compliance Mapping — Map policies to OWASP, NIST, SOC2, ISO 27001, GDPR
CI/CD Integration — Automated policy testing with GitHub Actions

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

Overview

Audit Event Types

Policy Operations

Approval Actions

Membership Changes

Authentication and Security

Filtering and Search

Exporting Audit Data

How to Export

Tamper Detection

Sensitive Data Redaction

Compliance Use Cases

SOC2 Type II — Access Controls

OWASP ASI — Security Event Monitoring

ISO 27001 — Change Management Evidence

Best Practices

​Overview

​Audit Event Types

​Policy Operations

​Approval Actions

​Membership Changes

​Authentication and Security

​Filtering and Search

​Exporting Audit Data

​How to Export

​Tamper Detection

​Sensitive Data Redaction

​Compliance Use Cases

​SOC2 Type II — Access Controls

​GDPR — Data Processing Accountability

​OWASP ASI — Security Event Monitoring

​ISO 27001 — Change Management Evidence

​Best Practices

​Related Guides

Overview

Audit Event Types

Policy Operations

Approval Actions

Membership Changes

Authentication and Security

Filtering and Search

Exporting Audit Data

How to Export

Tamper Detection

Sensitive Data Redaction

Compliance Use Cases

SOC2 Type II — Access Controls

GDPR — Data Processing Accountability

OWASP ASI — Security Event Monitoring

ISO 27001 — Change Management Evidence

Best Practices

Related Guides