Audit Logs

Audit Logs

Global Watch provides comprehensive audit logging to help organizations maintain accountability, meet compliance requirements, and investigate security incidents. This document explains our audit logging capabilities and how to use them effectively.

Overview

Audit logs capture a detailed record of all significant activities within your Global Watch account:

• Who: The user who performed the action
• What: The specific action taken
• When: Timestamp of the action
• Where: IP address and location (when available)
• Context: Additional relevant details

Logged Events

Authentication Events

All authentication-related activities are logged:

Account Events

Account management activities:

Member Events

Team member management:

Project Events

Project-related activities:

Asset Events

Asset management activities:

Data Access Events

Sensitive data access:

Accessing Audit Logs

In the Dashboard

Access audit logs through the Global Watch dashboard:

1. Navigate to Settings → Audit Logs
2. Use filters to narrow down results
3. Export logs for external analysis

Via API

Retrieve audit logs programmatically:

curl -X GET "https://api.global.watch/v1/audit-logs" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "start_date": "2024-01-01",
    "end_date": "2024-01-31",
    "event_type": "auth.login",
    "limit": 100
  }'

Response Format

Audit log entries follow this structure:

{
  "id": "log_abc123",
  "event_type": "project.created",
  "actor": {
    "id": "user_xyz789",
    "email": "john@example.com",
    "name": "John Doe"
  },
  "target": {
    "type": "project",
    "id": "proj_def456",
    "name": "Amazon Reserve"
  },
  "context": {
    "ip_address": "192.168.1.1",
    "user_agent": "Mozilla/5.0...",
    "location": "São Paulo, BR"
  },
  "metadata": {
    "account_id": "acc_ghi789",
    "changes": {
      "name": {
        "old": null,
        "new": "Amazon Reserve"
      }
    }
  },
  "timestamp": "2024-01-15T10:30:00Z"
}

Filtering & Search

Available Filters

Filter audit logs by various criteria:

Search Examples

Common search scenarios:

# Find all login attempts for a user
GET /audit-logs?actor_id=user_xyz&event_type=auth.login

# Find all changes to a specific project
GET /audit-logs?target_id=proj_abc123

# Find all admin actions in the last week
GET /audit-logs?event_type=member.*&start_date=2024-01-08

# Find failed login attempts from an IP
GET /audit-logs?event_type=auth.login_failed&ip_address=192.168.1.1

Retention & Storage

Retention Periods

Audit logs are retained based on your plan:

Long-Term Storage

For compliance requirements exceeding standard retention:

• Export Regularly: Schedule automatic exports
• SIEM Integration: Stream logs to your SIEM (Enterprise)
• Custom Retention: Extended retention available (Enterprise)

Compliance Use Cases

SOC 2 Compliance

Audit logs support SOC 2 requirements:

• Access Control: Track who accessed what and when
• Change Management: Document all system changes
• Incident Response: Investigate security events

GDPR Compliance

Support GDPR accountability requirements:

• Data Access Tracking: Log all personal data access
• Consent Records: Track consent changes
• Data Subject Requests: Document request handling

Internal Audits

Support internal audit processes:

• User Activity Review: Regular access reviews
• Permission Changes: Track role modifications
• Data Exports: Monitor data extraction

Security Considerations

Log Integrity

Audit logs are protected against tampering:

• Immutable: Logs cannot be modified after creation
• Checksums: Cryptographic verification available
• Timestamps: Server-side timestamps prevent manipulation

Access Control

Audit log access is restricted:

• Role-Based: Only admins can view full logs
• Self-Service: Users can view their own activity
• API Access: Requires specific permission

Best Practices

Regular Review

Alert Configuration

Set up alerts for critical events:

• Multiple Failed Logins: Potential brute force attack
• Admin Actions: Track privileged operations
• Data Exports: Monitor bulk data access
• API Key Creation: Track new integrations

Export Strategy

Maintain audit log archives:

1. Schedule Exports: Weekly or monthly exports
2. Secure Storage: Store exports in secure location
3. Retention Policy: Define archive retention period
4. Access Control: Limit who can access archives

API Reference

List Audit Logs

GET /v1/audit-logs

Parameters:

Export Audit Logs

POST /v1/audit-logs/export

Request Body:

{
  "format": "csv",
  "start_date": "2024-01-01",
  "end_date": "2024-01-31",
  "event_types": ["auth.*", "project.*"]
}

Related Documentation

• Security - Security measures and practices
• Data Protection - Privacy and GDPR compliance
• API Authentication - API security details