Evidence & Audit Trail
Every decision, automated or human, is permanently on record
ManySignal maintains a hash-chained audit log of every event in the platform: AI triage verdicts with reasoning traces, analyst actions with rationale fields, automated response executions with rollback state, and configuration changes with before/after diffs.
What is recorded in the audit trail
AI decisions
- Triage verdict + confidence score
- Full reasoning trace text
- Model ID and prompt version hash
- Evidence sources consulted
- Escalation or suppression result
Analyst actions
- Case status changes
- Manual triage overrides with reason
- Approval or rejection with comment
- SLA extension requests
- Evidence attachments added
Automated actions
- Workflow node execution results
- Action payloads sent to target systems
- API responses received
- Rollback invocations
- Kill switch activations
Configuration changes
- Detection rule deploys and promotions
- Guardrail modifications
- Autonomy level changes
- Context rule additions or retirements
- Connector authentication updates
Access events
- User logins to the platform
- API key creations and revocations
- Role assignments
- Tenant switching in MSSP context
- Data export requests
Data operations
- Retention policy changes
- Manual data deletion requests
- Evidence export bundles generated
- Cross-region replication config changes
- Encryption key rotation events
Hash-chained integrity, not just append-only storage
Each audit record includes a SHA-256 hash of the previous record, creating a chain where any tampering with a historical record is detectable by recomputing the chain. The chain root hash is published to an external witness service every 24 hours.
For legal hold and compliance purposes, any case or time window can be exported as a signed bundle: a ZIP containing the case record, all timeline entries, the evidence files, and a chain verification manifest. Verification is possible offline using the published chain root.
Audit trail use cases
SOC 2 Type II evidence
Auditors need evidence that access controls work and changes are approved. The audit trail exports as a structured report showing every configuration change, who made it, and what approval it received.
Incident post-mortem
Every decision made during an incident — AI and human — is timestamped and reasoned. Post-mortem reconstruction takes minutes rather than hours of log excavation.
Regulatory breach notification
The evidence bundle for a case includes the exact timeline of attacker actions, detection time, and response actions — the content regulators require in a breach notification, already assembled.
False positive review
When an analyst overrides a triage verdict, the rationale field is required. Over time, override patterns surface which detection rules or agents need tuning.
MSSP reporting
MSSPs can generate per-customer audit reports showing case volume, SLA compliance, response times, and automated action usage — branded and exportable as PDF.
Insider threat investigation
If a platform administrator is under investigation, the audit trail shows every action they took in the platform: cases they accessed, detections they modified, and actions they approved.
Evidence & Audit — FAQ
How long is the audit trail retained?
Audit records are retained for 7 years by default, independent of the event data retention window. Audit data is stored in a separate append-only store with no delete API — not the same store as normalized event logs.
Can platform administrators delete audit records?
No. There is no delete API for audit records. Even tenant administrators cannot purge audit entries. Deletion requests for compliance (e.g., GDPR right to erasure) are handled by pseudonymizing PII fields in the record, not deleting the record itself.
Is the audit trail available via the API?
Yes. All audit events are queryable via the REST API with filtering by time range, actor, event type, and entity. Streaming via webhook is also available for real-time forwarding to a SIEM or compliance tool.
Can I verify the chain integrity independently?
Yes. The chain root hash published every 24 hours, combined with the export manifest, allows verification using a standalone Python script we publish on GitHub. No ManySignal tooling required for verification.
What events does the audit trail capture?
Every significant platform action is captured: user logins, API calls, detection rule changes, verdict decisions, response action executions, approval grants, kill-switch activations, configuration changes, and data exports. Each entry includes actor identity, timestamp, entity affected, and before/after state where applicable.
How does the evidence trail help during regulatory audits?
Auditors can be granted read-only access to the audit trail API or receive a signed export bundle covering the audit period. The export maps agent decisions and response actions to the relevant control framework controls, reducing the manual evidence collection burden to near zero.
Can the audit trail be forwarded to a third-party SIEM or SIEM-as-a-service?
Yes. The audit stream is forwardable via webhook or syslog to any destination. Pre-built connectors exist for Splunk, Microsoft Sentinel, Elastic SIEM, and Google Chronicle. Streaming latency is under 5 seconds from event creation to forwarding.
What is the difference between the audit trail and raw event logs?
Raw event logs are security telemetry ingested from connectors — the source data. The audit trail records what the platform and its operators did: verdicts, actions, configuration changes. They are stored separately with different retention policies and different access controls.
Does ManySignal provide a chain-of-custody document for legal proceedings?
Yes. The evidence export includes a chain-of-custody manifest signed by ManySignal's platform certificate, listing each evidence item, its acquisition timestamp, hash, and the operator who exported it. This format is accepted by most legal discovery and forensic review processes.
Audit-ready by default, not as an add-on
Every ManySignal deployment ships with the full audit trail. No compliance module, no additional configuration.