Overview
The Audit Log page displays all recorded events within your organization, providing visibility into who did what, when, and from where. Audit logs are essential for compliance with regulations like SOC 2, ISO 27001, HIPAA, and GDPR. Key Features:- Comprehensive event logging
- Organization-scoped logs
- Chronological event display
- Event details and metadata
- Timestamp tracking
- Tamper-proof records
- Export capabilities (planned)
- Long-term retention
What Gets Logged
Nexus Access Vault logs a wide range of events across all modules:User Events
Authentication
- User login (success/failure)
- User logout
- MFA challenges
- Password changes
- Account lockouts
Authorization
- Resource access attempts
- Permission grants
- Permission denials
- Policy evaluations
- Role changes
Session Activity
- Session start
- Session end
- Session timeout
- Idle warnings
- Connection changes
Profile Changes
- Profile updates
- Email changes
- Phone number changes
- Organization assignment
- Group membership changes
Administrative Events
User Management
User Management
- User account creation
- User account deletion
- User account suspension
- Role assignment changes
- Bulk user imports
Resource Management
Resource Management
- Application creation
- Application deletion
- Application configuration changes
- Resource assignment to users
- Resource assignment to groups
Policy Management
Policy Management
- Policy creation
- Policy activation
- Policy deactivation
- Policy modification
- Policy deletion
Group Management
Group Management
- Group creation
- Group deletion
- Member additions
- Member removals
- LDAP sync events
Organization Management
Organization Management
- Organization creation
- Organization deletion
- Organization settings changes
- Branding updates
Device Events
- Device enrollment
- Device trust level changes
- Device status changes (active/revoked/compromised)
- Device re-enrollment
- Device access revocation
- Fingerprint verification
System Events
- Configuration changes
- System errors
- Integration events (LDAP, Tailscale, etc.)
- Backup operations
- Security alerts
Audit Log Display
The audit log page shows events in reverse chronological order (newest first): Implementation:src/pages/Audit.tsx:15
Log Entry Structure
Log Entry Display
Each log entry is displayed in a card:- Event name (bold)
- Timestamp in local format
- Event details (when expanded)
Log Data Organization
Organization Scoping
Audit logs are automatically filtered by organization:- Users only see logs from their organization
- Complete tenant isolation
- No data leakage between organizations
- Compliance with data privacy regulations
Pagination
Currently limited to 50 most recent logs. Future enhancements will include:- Infinite scroll or pagination
- Date range filtering
- Event type filtering
- User filtering
- Resource filtering
- Export to CSV/JSON
Event Details
Each audit log entry includes detailed metadata in thedetails field:
Example Event Details
- User Login
- Resource Access
- Policy Change
- Device Event
Timestamp Format
Timestamps are displayed in the user’s local timezone:- Short:
1/15/2024, 10:30 AM - Long:
January 15, 2024 at 10:30:00 AM CST - Relative: “2 hours ago”, “Yesterday”, “Last week”
Loading States
Loading Indicator
While logs are being loaded:Empty State
If no audit logs exist:Compliance Use Cases
SOC 2 Type II
Demonstrate logging of all access to customer data and administrative actions
ISO 27001
Maintain audit trails for information security management
HIPAA
Track all access to protected health information (PHI)
GDPR
Document data access and deletion for GDPR compliance
PCI DSS
Log access to cardholder data environments
NIST 800-53
Comprehensive audit logging for federal compliance
Security Monitoring
Anomaly Detection Signals
Audit logs can reveal security incidents:Multiple Failed Logins
Multiple Failed Logins
Pattern of failed login attempts may indicate brute force attack
Unusual Access Times
Unusual Access Times
Access outside normal hours may indicate compromised credentials
Geographic Anomalies
Geographic Anomalies
Logins from unexpected locations may indicate account takeover
Privilege Escalation
Privilege Escalation
Sudden increase in permissions may indicate insider threat
Bulk Operations
Bulk Operations
Mass data exports or user deletions may indicate malicious activity
Policy Disabling
Policy Disabling
Deactivation of security policies may indicate attack in progress
Audit Log Best Practices
Alert Configuration
Set up alerts for critical events (failed logins, policy changes, admin actions)
Future Enhancements
Planned Features:
- Advanced filtering (date range, event type, user, resource)
- Full-text search across event details
- Export to CSV, JSON, and SIEM formats
- Real-time log streaming
- Automated threat detection
- Compliance report generation
- Log forwarding to external SIEM
- Retention policy configuration
Common Event Types
Event naming convention:<module>.<action>.<result>
Authentication Events
auth.login.successauth.login.failureauth.logoutauth.mfa.challengeauth.mfa.successauth.password.changed
Access Events
resource.access.grantedresource.access.deniedsession.startedsession.endedpolicy.evaluated
Administrative Events
user.createduser.deleteduser.role.changedgroup.createdgroup.deletedpolicy.createdpolicy.activatedpolicy.deactivated
Device Events
device.enrolleddevice.revokeddevice.trust.changeddevice.compromised
Integration with SIEM
Audit logs can be exported and forwarded to external Security Information and Event Management (SIEM) systems for:- Advanced correlation and analysis
- Cross-platform security monitoring
- Long-term archival
- Compliance reporting
- Threat intelligence enrichment
Related Features
- Application Management - Resource access events are logged
- Session Management - Session events are logged
- Device Management - Device changes are logged
- Policies - Policy evaluations are logged
- User Groups - Group changes are logged
- Organization Management - Org changes are logged