Audit Logging

Biztraak records supported infrastructure, deployment, access, and governance events as audit records.
These records help teams understand what happened, when, and in which project or component context. The events and retention available depend on the workflow and configuration in use.
They are intended to support operational review and evidence gathering. An audit record is not by itself an assurance or certification.

Why audit logs matter

• Governance evidence: review teams often need proof that controls and operational practices were followed.
• Security Incidents: supported audit records can assist with investigating incidents and reconstructing related activity.
• Operational Oversight: teams can trace dependencies and understand impact.
• Governance context: supported events can be reviewed alongside controls, checklists, or governance workflows.

Traditional review workflows often rely on manual screenshots, tickets, or siloed logs. Biztraak can keep supported operational records closer to the project and deployment workflow.

What gets logged

• Infrastructure Deployments

  • VPCs created, IAM roles configured, DB encryption enabled, storage buckets provisioned.

• Application Deployments

  • Pipeline runs, commit hashes, artifact fingerprints, environment variable injections.

• Access Control Events

  • Role changes, service provider credentials, secret usage and rotation.

• Compliance Events

  • Each action can be linked to internal controls, review checklists, or governance workflows.

• Secrets Management

  • Workflows that record secrets-management events can include key creation, usage, rotation, and deletion with timestamps.

Context varies by event. Records for component-scoped activity can include component, project, and team-member context, giving you traceability for the recorded activity.

How audit logging works

1. Trigger

   • An infra or code deployment is initiated.

2. Capture

   • Runners and templates emit structured events (IDs, configs, outcomes).

3. Mapping

   • When the selected workflow includes control mapping, events can be associated with controls or review items your team is tracking.

4. Storage

   • Logs are stored according to the configured platform retention and storage behavior.

5. Sync

   • Governance workflows can consume events when their integration accepts the event type.

Example Workflow

1. A developer pushes a commit to the main branch.
2. The configured source-control pipeline runs in the configured provider or runner environment. This may be the client’s cloud account when that is the selected provider path.
3. Audit log entries are generated:
   • Commit hash: abc123
   • Build artifact hash: sha256:xyz
   • IAM role used: arn:aws:iam::...:role/Deployer
   • Secret rotation event: db_password rotated at 2025-09-01 10:34:00 UTC
4. When compliance mappings are configured:
   • Change-management review items can be updated
   • Workforce access review items can be updated
5. When governance workspace sync is configured, the client’s workspace can receive the updated log and evidence for related controls.

Features

• Traceable: records retain event context and timestamps according to the configured storage behavior.
• Searchable: filter by project, component, user, date, or control.
• Exportable: export options depend on the event type and enabled workflow.
• Integrations: supported integrations can forward records to external monitoring or governance tools.
• Dashboards: visualize deployment history, compliance coverage, and incident traces.

Benefits

• For Developers: logs double as a dependency graph, showing how infra outputs flow into code.
• For Compliance Teams: supported evidence context can be collected closer to the underlying activity.
• For Reviewers: a read-only governance portal can show logs tied directly to the controls your team tracks.
• For Executives: reduces the time spent assembling evidence for internal or customer reviews.

Roadmap

• Policy-Driven Logging: define required log events, block deployments if missing.
• Cross-Framework Log Mapping: single event mapped to multiple frameworks simultaneously.
• Machine Learning Insights: anomaly detection and automated incident classification.

Next steps

• Compliance Overview → see how audit logs fit into the full compliance model
• Controls → learn how logs map into governance controls
• Framework Support → broader governance workflow context

With Biztraak, supported audit records keep operational activity closer to review and governance workflows.
Use the available records as evidence context, and confirm the coverage and export behavior required for your specific review program.