Audit log

The audit trail records who did what, when, from where and why. Every change through the API writes a record, whichever way it came: the admin UI, the weikio CLI, a pipeline’s weikio apply or a script calling the API. The trail is kept in its own stream at the hub, which the backend’s own credentials can’t delete or shorten, for 400 days.

What is audited#

• Every request that changes something, with the diff of the record before and after.
• A configuration apply, as one record of the whole file and one record per document it created, updated or deleted, with the repository, branch and commit the pipeline applied from.
• Secret reveals, and each delivery of secrets to a deployment.
• Agent enrolments, revocations, new bundles and repoints.
• Sign-ins, failed sign-ins, sign-outs, account locks, password changes, authenticator enrolments and resets, and grants a claim mapping gave at sign-in.
• Break-glass windows opened and closed, and every request of a break-glass session.
• Backups taken, restores run and documents restored, and the steps an upgrade applied.
• Every read of the audit trail itself.

Each record has the time, the actor, the action, the target, the outcome, the caller’s address, the reason given and a correlation id shared by everything one request did. A change applied from a pipeline also gives the commit, so weikio describe integration shows applied from weikio-integrations@a1b2c3d and the audit record links the same commit.

Query the trail#

$ weikio audit query --since 7d --target-kind secret

The records print newest first, 100 to a page and at most 1,000, with the time, the actor by e-mail, the action in the admin UI’s words, the target, the outcome and the caller’s address. The filters:

• --since 24h, or --from and --to, for the window
• --actor for a user’s or a key’s ID, and --action for an action such as SecretRevealed, BackupTaken or UpgradeStepApplied
• --target-kind and --target for one record, such as --target-kind deployment --target production.finance.erp-invoice-export
• --outcome ok, denied, refused or error
• --project and --env for a project’s and an environment’s records

A page that has more ends with the command that shows the older records. -o json prints the records as the API returns them, each with its sequence number. The query is itself audited.

weikio audit show <correlation-id> prints every audit record and every log line of one correlation id in time order. The CLI sends a correlation id with every call, so one command’s records and the backend’s log lines about it read as one story.

Who may read it#

A platform administrator sees the whole trail. A project’s admin, a grant of the admin role in every environment of the whole project, sees the records of that project. Everyone else follows their projects’ changes with weikio activity, which lists the changes without reads, sign-ins, secret deliveries and dry runs, and isn’t itself audited.

In the admin UI#

Settings › Operations › Audit log lists the records for 24 hours, 7 days, 30 days or the whole 400 days, with its outcome filter and an Actions picker among its filters. The toolbar shows the weikio audit query line of the same filter, and a record opens its correlation with everything that one request did.

/settings/audit

Forward the trail to a SIEM#

The telemetry forwarder reads every audit record from the trail and sends it to your SIEM, Splunk or any system that accepts OTLP, with each record kept on the forwarder’s disk until the destination accepts it. A record arrives as one log record with the event name weikio.audit.record and attributes such as weikio.audit.action, weikio.audit.actor.display, weikio.audit.target.name, weikio.audit.outcome, weikio.audit.origin.commit and weikio.audit.diff. Telemetry forwarding has the configuration and how to drop repeats.

Audit and backups#

Every backup archive contains the audit trail, so a restore brings it back. The restored trail ends just before the archive’s own BackupTaken record, and the restore itself is in the trail as RestoreRun, with the archive it restored.