Skip to Content
SecurityAudit Logging

Audit Logging

Slim.io records a comprehensive audit trail of all significant operations on the platform. Every action that modifies data, configuration, or access controls is logged with the actor’s identity, timestamp, and operation details. Audit logs support compliance requirements, incident investigation, and operational monitoring.

What Gets Logged

Scan Operations

EventDetails Captured
Scan startedInitiator, connector, scan type (full/incremental/event-driven), scope
Scan completedDuration, files processed, findings count, error count
Scan cancelledCancelling user, reason, files processed at cancellation
Scan failedError details, last processed file, partial results

Policy Operations

EventDetails Captured
Policy createdAuthor, policy name, mode (dry-run/enforced), YAML content hash
Policy updatedAuthor, changed fields, previous vs. new values
Policy deletedDeleting user, policy name
Policy evaluatedPolicy name, findings matched, actions executed, outcomes
Policy mode changedAuthor, previous mode, new mode

Connector Operations

EventDetails Captured
Connector createdCreator, provider, target bucket/container, permissions granted
Connector updatedChanged fields (credentials rotated, scope changed)
Connector deletedDeleting user, connector name
Connection testSuccess/failure, latency, error details

Data Access

EventDetails Captured
Finding viewedViewer, finding ID, category
Token decryptedDecryptor, token IDs, finding context
Bulk exportExporter, scope, record count, export format
Data Catalog searchSearcher, query terms, result count

Access Control

EventDetails Captured
User loginUser email, auth method (password, SSO), IP address
User logoutUser email, session duration
Role assignmentAdmin, target user, role granted
Role revocationAdmin, target user, role removed
SSO configurationAdmin, provider, settings changed
API key createdCreator, key scope, permissions
API key revokedRevoker, key ID, reason

Workspace Operations

EventDetails Captured
Workspace createdCreator, workspace name, initial configuration
Member added/removedAdmin, member email, role
Workspace settings changedAdmin, changed fields

Audit Log Format

Each log entry contains a standard set of fields:

FieldDescription
timestampISO 8601 timestamp with millisecond precision
event_typeDotted event identifier (e.g., scan.started, policy.created)
actorEmail and role of the user or service account that performed the action
tenant_idTenant context for multi-tenant isolation
workspace_idWorkspace scope (if applicable)
resource_typeType of resource affected (scan, policy, connector, finding)
resource_idUnique identifier of the affected resource
detailsAction-specific metadata (varies by event type)
ip_addressSource IP of the request
user_agentClient identifier

Viewing Audit Logs

Dashboard

Navigate to Settings > Audit Log in the Customer Dashboard to view, search, and filter the audit trail.

Available filters:

  • Date range
  • Event type
  • Actor (user email)
  • Resource type
  • Keyword search across event details

API

GET /api/v1/governance/audit-log?start=2026-03-01T00:00:00Z&end=2026-03-27T23:59:59Z&event_type=policy.*&limit=100
Authorization: Bearer $TOKEN

Response:

{
  "status": "success",
  "data": {
    "entries": [
      {
        "timestamp": "2026-03-15T10:30:00.123Z",
        "event_type": "policy.created",
        "actor": { "email": "admin@company.com", "role": "admin" },
        "resource_type": "policy",
        "resource_id": "tokenize-financial-pii",
        "details": {
          "mode": "dry-run",
          "conditions_count": 2,
          "actions_count": 2
        }
      }
    ],
    "total": 47,
    "next_cursor": "cursor-abc-123"
  }
}

Retention

TierDefault RetentionMaximum Retention
Starter30 days30 days
Professional90 days1 year
Enterprise90 daysUnlimited (configurable)

Audit logs can be exported to your SIEM or log management platform via the webhook integration. Configure a webhook with the audit.* event filter to stream logs in real time.

SIEM Integration

Export audit logs to external security information and event management (SIEM) systems:

  1. Navigate to Settings > Integrations > SIEM Export.
  2. Configure the destination (Splunk, Datadog, Elastic, or generic webhook).
  3. Select the event types to export.
  4. Set the export format (JSON or CEF).

Supported destinations:

SIEMIntegration Method
SplunkHTTP Event Collector (HEC)
DatadogDatadog Logs API
ElasticElasticsearch bulk API
GenericCustom webhook endpoint

Compliance Use Cases

Audit logs support the following compliance frameworks:

  • SOC 2 (CC7.2) — Monitoring of system operations and anomaly detection
  • HIPAA (164.312(b)) — Activity logs and audit controls for PHI access
  • PCI-DSS (Req. 10) — Tracking and monitoring all access to network resources and cardholder data
  • GDPR (Art. 30) — Records of processing activities with purpose and legal basis

For detailed compliance mapping, see Compliance.

Last updated on
Identity & SSOCompliance