Skip to main content
Every action taken across the Essal platform — whether via the dashboard, API, or a connected integration — is recorded in the Guard audit log. The audit log is immutable, tamper-evident, and central to security and compliance investigations.

​
What Gets Logged

The audit log captures:
  • All API requests (successful and failed)
  • Authentication events (logins, logouts, MFA verifications, failed attempts)
  • Permission changes (role updates, policy activations, SSO changes)
  • Data modifications (create, update, delete on any entity)
  • Administrative actions (workspace settings changes, user provisioning)

​
Log Entry Format

​
Accessing Audit Logs

Query audit logs via the Guard API or the Essal dashboard. See View Audit Trail for filter options and export instructions.

​
Retention

Configure retention in Guard → Settings → Retention.

​
Tamper Evidence

Audit log entries are signed with a per-entry hash chain. Any modification to an existing entry would invalidate all subsequent hashes, making tampering detectable. Essal’s internal compliance monitoring scans for hash chain breaks on a continuous basis.

​
SIEM Integration

Export audit logs to your SIEM in real time by subscribing to Guard events via webhooks or using the streaming export endpoint in ndjson format.