Audit Trail

Security Hub's tamper-evident event log for every authentication, authorization, data-access, and admin action — with category filtering, search, and CSV export.

Overview

Audit Trail is Security Hub's tamper-evident, hash-chained event log — a chronological record of authentication, authorization, data-access, configuration-change, security-action, admin-action, and API-call events across the platform. Every entry carries an actor, target, source IP, and result (success/failure), and the log can be filtered, searched, and exported.

Not the same as Security Audit

Security Audit logs scan findings (CVEs, code-analysis results). Audit Trail logs who did what, when — user and system actions. Both live under Security but serve different purposes.

Quick Start

Open Audit Trail from the Security sidebar.
Use the category rail on the left to filter by event type (Authentication, Authorization, Data Access, Configuration, Security Action, Admin Action, API Call), or search by actor, action, or target.
Click any row to expand it and see the full timestamp, source IP, and event detail.
Click Export CSV to download the currently filtered set of events.

Event Categories

Category	Examples
Authentication	Login, failed login
Authorization	Permission grant, access denied
Data Access	Secret revealed, report exported
Configuration	Settings updated, API key rotated
Security Action	Scan initiated, block rule created
Admin Action	User created, team membership changed
API Call	Every authenticated API request with method, path, status

Features

Tamper-Evident Log

Events are hash-chained — the sidebar footer note reminds you the log is designed so historical entries cannot be silently altered.

Search & Category Filter

Search across actor, action, and target text, or narrow to a single event category from the left rail.

CSV Export

Export the currently filtered event list as CSV for sharing or long-term archival outside the app.

AI Assistant

Every screen in Security Hub now ships with an embedded AI Assistant, opened from the vertical AI Assistant tab on the right edge of the screen. The assistant reads the data currently on screen — the currently filtered event list, or the single event you have expanded — and answers questions, triages findings, or drafts a remediation plan directly in the chat panel.

Event Summary

Summarize the current events by category and actor without scanning every row yourself.

Suspicious Pattern Review

Ask whether any of the current events look suspicious or worth following up — repeated failures, unusual actors, etc.

Repeated Failures

Find repeated failed authentication or authorization events that could indicate credential stuffing or privilege probing.

Save as Report & Add Knowledge

Any assistant reply can be saved as a report (available later from My Reports) via the Save as Report button under the last message. Click Add Knowledge in the input dock to attach files or notes from your Knowledge library so the assistant's answers can reference them.

FAQ

Can admins delete audit trail entries?

No — entries are append-only. The hash-chained design is intended to make silent deletions or edits detectable.

How is this different from Security Audit?

Security Audit tracks scan findings (vulnerabilities found by code/dependency analysis). Audit Trail tracks user and system actions (logins, permission changes, API calls) — different data, same Security area.