Audit Access
What this screen is for
Audit Access is the trail of the trail: who read whose audit records, through which endpoint, and how much it returned. Every read served by the audit service is recorded, whether a tenant administrator opening their Audit Log, a platform administrator opening the global one, or a program calling the API. The one exception is this screen itself: reading the access trail, including exporting it, writes no record.
Each record names the reader, the reader's tenant, the client address the request claimed, the subject tenant the read addressed or that it was platform-scoped and addressed no single tenant, the normalized endpoint and its query, how many records came back, and the outcome. A read that was refused is recorded with outcome FAILURE. When the reader was a platform administrator working inside a tenant, the record names both the operator and the account they operated as, and the operator is the one held accountable.
The read is always served: when the access record cannot be written it is held in memory and retried, so a store outage does not stop the audit screens. That buffer is bounded and does not survive a restart of the audit service.
What must exist first
This is a platform screen, reached in the platform context; opening it inside a tenant sends you to that tenant's Dashboard. Before you work here:
- The
audit.meta.readpermission, which shows the sidebar entry and every mode of the screen. The platform super administrator and auditor roles hold it; the platform viewer does not. Without it the screen states that this permission is required and offers nothing else. - The permission to list tenants, for tenant names. Without it the rankings and the table show tenant identifiers.
Decisions you make here
Choosing the window
The window is a range of whole UTC days, seven ending today unless you choose otherwise, and it is shared by the three modes and carried in the address, so a link reproduces the whole question. The bar states the longest window your installation serves, 92 days unless the deployment set another. A wider selection is kept on screen and not applied, and the bar says so; narrow it and it applies.
Monitoring the window
Monitor opens first. Signals are four questions the server evaluates: refused reads; readers touching a subject tenant for the first time within the preceding 90 days; reads returning far more records than the window's other reads; and readers whose daily reads burst against their own 28-day baseline. Every threshold is derived from the data, none is set by a caller, and each card prints the rule it applied and the window it evaluated, which for the last two reaches back before the window you chose.
A card is in one of three states: Not measurable in this window, when the data cannot answer the question, for instance too few reads for a percentile; Measured — nothing found; or Found N with the unit counted, pairs, readers or reads, and its contributors. Selecting a found card or a contributor opens Investigate with that filter applied.
The four rankings below list the top ten reader identities, reader tenants, endpoints and subject tenants by reads in the window. Each states the period total and the population it was counted over, that bar length is relative to the largest row shown, and when the ranking was cut at its limit. Reader and subject are different axes: the reader ranking says who read, the subject ranking says whose trail was read, and platform-scoped reads are in the first and not the second.
Investigating
Investigate lists the reads that match the window and the filters, twenty per page, newest first. You may filter on the reader axis by Reader username, Reader tenant and Client IP (claimed), and on the subject axis by Subject tenant, including Platform-scoped (no single tenant), by Resource (normalized endpoint), by Outcome, and by Minimum records returned.
A filter the server would refuse, an outcome that is not a domain outcome or a record count that is not a whole number, is refused on screen before anything is sent, and nothing is silently dropped. Apply filters sends them and Clear filters removes them, keeping the window.
The reader column names the accountable human: on a read performed inside a tenant context, the operator first, then the account they operated as. Filtering by reader username matches that accountable human, not the account.
Here the operator is always named by login. On an ANKA-hosted deployment the tenant reading its own access log sees that operator only as Platform operator with a short reference, the operator's platform identity id, which the platform identity screen resolves.
Attesting the period
Attest shows Chain verdict: whether the audit-access records were last verified intact, projected from the Audit Integrity verification and never computed here. It is Never verified in this environment until a verification has decided something for this record type, which is neither a pass nor a failure; then INTACT or BROKEN, with how many chains were covered, how many are broken and how many contributing runs did not complete. The figures are counts and never a percentage, and the panel says why: a coverage denominator would have to span every record type.
Export period as CSV downloads every access record in the window that matches the filters in force, as one file with the columns listed on screen, and names the filter it applied. The export stops at a row ceiling set for your installation, 10,000 rows by default; when it does the console warns that the file is not the whole period, and the file's last record says EXPORT COMPLETE or EXPORT TRUNCATED either way. When the download did not state which, the console asks you to read that last record before trusting the file. A refused filter blocks the export as it blocks the list.
How it relates to other screens
The verdict on the Attest tab is one row of the platform-wide verification, which is started and read in full there:
Most of the reads recorded here are tenants opening their own Audit Log, and a platform administrator's reads inside a tenant are attributed to the operator: