VERISCO Shield Monitor and respond
Audit log
A record of every change to your tenant's configuration, chained so that an altered or missing entry can be detected by you, without trusting us.
Open Audit Log in your console, under Observe.
What is recorded#
Changes to your own configuration, with who made them, when, and from where: a policy altered, a team member invited, a licence changed, a session ended, your database credentials updated. For a changed setting the entry records the value before and after.
This is a different record from Sign-in Activity, which lists your users signing in.
A policy save records the settings it changed, each with its old value and its new one, and nothing else. Switching the network policy off reads as mode: enforce → off. A session ended by a rule is recorded as done by the network re-check or the device re-check, and marked automatic.
Reading it#
The page lists the newest entries first: when, who, what, and the details. For a change the details are each setting with its old value struck through and its new one beside it. Search looks at the person, the action and the settings that changed, so typing the name of a setting finds every time it was altered. An entry made by one of the platform's own operators, not by one of your administrators, is marked platform operator; see support access.
Security Events, the page below it, is the identity provider's list of your users signing in. Clear All Logs on that page deletes those sign-in events for good; the clearing itself is written here, with who did it and how many events there were.
Why it is chained#
A log that the provider can edit proves nothing about the provider. So each entry carries the hash of the entry before it, and its own hash covers both. Change a field, remove a row or swap two rows, and every hash from that point on stops matching.
Export it#
Use Export on the Audit Log page. The export carries the chain with it.
Check it yourself#
A platform that verifies its own audit log is asserting, not proving. So the check is a separate program you run on the exported file alone: one Python file, standard library only, short enough to read end to end. Ask us for it.
python3 verify_export.py verisco_audit_export.csvIt answers three questions, kept apart because they mean different things:
| Question | Meaning |
|---|---|
| Does the chain hold? | Every row is hashed together with the hash of the row before it. The first row that does not match is named. |
| Is every row covered? | A row with no hash is counted and reported. It is not evidence of tampering, and it is not proof of anything either. |
| Where does the export start? | An export filtered by date begins mid-chain, so its first row points at a row that is not in the file. That is expected, and reported as such. |
What it cannot tell you
A chain shows that nothing was changed in the middle. It cannot show that rows were removed from the end. Export regularly and keep the last hash: a later export must still contain it.
Who can see it#
Every role can read the audit log. Clearing sign-in logs needs the Administrator role. See Team and roles.
Something missing or wrong on this page? Tell us and we will fix it.