Skip to main content

Audit Logging

Guardian Pro maintains a comprehensive audit trail of every action taken within your organization. Every scan, remediation, configuration change, and user action is recorded with full context, providing the accountability and traceability required for security governance and compliance reporting.

What Gets Logged​

Guardian Pro captures audit events across all operations in the platform:

User Actions​

ActionDetails Logged
Sign in / Sign outUser identity, timestamp, IP address, success/failure status
Account switchUser, source account, target account, timestamp
Remediation initiatedUser, finding ID, resource, action taken, approval status
Remediation completedOutcome (success/failure), changes applied, duration
Rollback initiatedUser, remediation ID, reason, resource affected
Settings changedUser, setting name, previous value, new value
User invitedInviting user, invited email, assigned permissions
User removedRemoving user, removed user identity
Framework subscribedUser, framework name, timestamp

System Actions​

ActionDetails Logged
Scan startedTrigger (scheduled/manual), account, timestamp
Scan completedDuration, resources discovered, findings generated, health score
Cost analysis runAccount, time period, anomalies detected
Compliance assessmentAccount, framework, score, controls passed/failed
Architecture analysisAccount, risks detected, health score changes

Data Access​

ActionDetails Logged
Findings viewedUser, finding IDs accessed
Cost data accessedUser, account, time range
Export generatedUser, export type (PDF/CSV/JSON), data scope
AI Assistant queriesUser, query topic, capabilities used

Correlation IDs​

Every action in Guardian Pro is tagged with a correlation ID -- a unique identifier that links related events across the system. This is especially valuable for:

  • Tracing a remediation end-to-end -- From the user clicking "Fix" through the preview, execution, status checks, and final outcome, every step shares the same correlation ID.
  • Debugging issues -- If a scan produces unexpected results, the correlation ID lets support trace the entire scan pipeline.
  • Connecting user actions to system events -- When you initiate a remediation, the correlation ID connects your click to the backend execution, status updates, and any subsequent rollbacks.
tip

When contacting support, include the correlation ID from the relevant action. This dramatically speeds up investigation.

Finding Correlation IDs​

Correlation IDs appear in several places within the Guardian Pro console:

  • Remediation details -- Each remediation record shows its correlation ID.
  • Scan results -- Each scan execution includes a correlation ID.
  • Error messages -- When an operation fails, the error message includes the correlation ID.

Viewing Audit Logs​

From the Guardian Pro Console​

  1. Navigate to Settings in the sidebar.
  2. Select Audit Log (available to users with organization read permissions).
  3. Browse the chronological list of events.

Filtering​

Audit logs can be filtered by:

  • Date range -- View events within a specific time period.
  • User -- Filter to actions taken by a specific team member.
  • Action type -- Show only remediations, only sign-ins, only configuration changes, etc.
  • Account -- Scope to events affecting a specific AWS account.
  • Correlation ID -- Search for a specific correlation ID to see all related events.

Exporting​

Audit logs can be exported for external analysis or compliance evidence:

  • CSV -- Tabular format suitable for spreadsheet analysis.
  • JSON -- Structured format for integration with log aggregation tools.
info

Audit log exports include all events matching your current filters. For large date ranges, exports may take a moment to generate.

Remediation Audit Trail​

Remediations have the most detailed audit trail in Guardian Pro, since they involve changes to your AWS infrastructure:

Every step of a remediation or rollback is recorded in the audit trail -- from the initial request through execution and outcome. This provides a complete chain of custody for compliance evidence.

note

Every event in the remediation lifecycle includes the same correlation ID, making it easy to trace the full history of any remediation from start to finish.

Audit Logs for Compliance​

Audit logs are a critical component of compliance evidence. Guardian Pro's audit trail supports compliance requirements by providing:

  • Immutable records -- Audit events cannot be modified or deleted by users.
  • Timestamp accuracy -- All events are timestamped with UTC precision.
  • User attribution -- Every action is linked to the user who performed it.
  • Change tracking -- Before and after states are recorded for configuration changes.

Using Audit Logs for Compliance Evidence​

When preparing for compliance audits (SOC 2, ISO 27001, GDPR, etc.):

  1. Navigate to Audit Logs and set the date range to your audit period.
  2. Filter by action type to show relevant events (e.g., all remediations, all access events).
  3. Export the filtered logs as CSV or JSON.
  4. Include the export in your compliance evidence package alongside your Compliance Dashboard reports.
tip

Combine audit log exports with compliance framework exports from the Compliance Dashboard to create a comprehensive evidence package for auditors.

Retention​

Every audit event is kept for 365 days from the time it was recorded, then deleted automatically. The same retention applies on every plan.

Audit logs are not deleted with the rest of your data when your organization's data is deleted: they are kept until their own 365-day expiry. A legal hold can delay deletion until it is lifted. See Data Privacy.

info

If your compliance requirements mandate longer retention, export audit logs regularly to your own log management system.

Frequently Asked Questions​

Can audit logs be modified or deleted? No. Audit logs are immutable. Once an event is recorded, it cannot be altered or removed by any user, including administrators. Each event expires automatically 365 days after it was recorded (see Retention).

Do audit logs include AI Assistant conversations? Audit logs record that an AI Assistant query was made, including the topic category and capabilities used. The full conversation content is stored separately in the conversation history.

Are failed actions logged? Yes. Failed sign-in attempts, failed remediations, and other unsuccessful actions are all recorded in the audit log with their failure reasons.

Can I set up alerts based on audit events? Guardian Pro's notification system can alert you on key events such as remediation actions. For custom alerting based on audit events, export the audit log to your own log management system.

Next Steps​