Audit Logging

TwinEdge Enterprise provides comprehensive audit logging for compliance, security, and operational visibility.

Enterprise Feature

Full audit logging and export capabilities are available on Enterprise plans. Professional plans include basic activity logs.

Overview

Audit logs capture:

• User actions: Login, data access, configuration changes
• System events: API calls, service events, alerts
• Security events: Authentication failures, permission changes
• Data access: Who accessed what data, when

Viewing Audit Logs

Audit Log Dashboard

1. Go to Settings → Audit Log
2. View recent events in timeline
3. Use filters to narrow results

Log Entry Details

Each log entry includes:

{
  "id": "log-123456",
  "timestamp": "2026-01-06T10:30:00Z",
  "actor": {
    "id": "user-789",
    "email": "john@company.com",
    "type": "user"
  },
  "action": "dashboard.update",
  "resource": {
    "type": "dashboard",
    "id": "dash-456",
    "name": "Production Overview"
  },
  "result": "success",
  "ip_address": "192.168.1.100",
  "user_agent": "Mozilla/5.0...",
  "changes": {
    "before": {"name": "Overview"},
    "after": {"name": "Production Overview"}
  }
}

Event Categories

Authentication Events

Event	Description
auth.login	User logged in
auth.logout	User logged out
auth.login_failed	Failed login attempt
auth.password_reset	Password reset requested
auth.mfa_enabled	MFA enabled
auth.sso_login	SSO authentication

User Management Events

Event	Description
user.created	New user created
user.updated	User profile updated
user.deleted	User deleted
user.role_changed	User role modified
user.invited	User invitation sent

Data Access Events

Event	Description
data.query	Data query executed
data.export	Data exported
data.view	Dashboard/report viewed
data.download	File downloaded

Configuration Events

Event	Description
datasource.created	Data source added
datasource.updated	Data source modified
datasource.deleted	Data source removed
dashboard.created	Dashboard created
dashboard.updated	Dashboard modified
dashboard.deleted	Dashboard deleted
alert.created	Alert rule created
alert.updated	Alert rule modified
alert.deleted	Alert rule deleted

Security Events

Event	Description
apikey.created	API key generated
apikey.revoked	API key revoked
role.created	Custom role created
role.updated	Role permissions changed
permission.changed	User permissions modified

Fleet & OTA Events

Event	Description
device.registered	Device registered
device.command	Command sent to device
ota.deployment_created	OTA deployment started
ota.deployment_completed	OTA deployment finished
ota.rollback	Rollback initiated

Filtering & Search

Basic Filters

Filter	Options
Time Range	Last hour, 24h, 7d, 30d, custom
Actor	Specific user or "System"
Action	Event type
Result	Success, failure, error
Resource Type	Dashboard, data source, user, etc.

Advanced Search

Use query syntax for complex searches:

actor.email:john@company.com AND action:dashboard.* AND result:success

resource.type:datasource AND timestamp:[2026-01-01 TO 2026-01-31]

ip_address:192.168.1.* AND action:auth.login_failed

Saved Searches

Save frequently used searches:

1. Configure filters
2. Click Save Search
3. Name the search
4. Access from Saved Searches dropdown

Export & Integration

Manual Export

Export audit logs for analysis:

1. Configure filters
2. Click Export
3. Choose format:
   • CSV: For spreadsheets
   • JSON: For programmatic processing
   • PDF: For reports
4. Download file

Scheduled Exports

Automate audit log exports:

1. Go to Settings → Audit Log → Scheduled Exports
2. Click Create Schedule
3. Configure:
   • Frequency: Daily, weekly, monthly
   • Format: CSV, JSON
   • Destination: Email, S3, SFTP
4. Save schedule

SIEM Integration

Forward audit logs to your SIEM:

Splunk

splunk:
  enabled: true
  hec_url: https://splunk.company.com:8088
  hec_token: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
  index: twinedge_audit
  source_type: twinedge:audit

Elastic/ELK

elasticsearch:
  enabled: true
  hosts:
    - https://elastic.company.com:9200
  index: twinedge-audit
  api_key: xxxxxxxxxxxxxxxxxx

Generic Webhook

webhook:
  enabled: true
  url: https://your-siem.com/api/events
  headers:
    Authorization: Bearer YOUR_TOKEN
  batch_size: 100
  flush_interval_seconds: 60

API Access

Query audit logs programmatically:

GET /api/v1/audit/logs?
  start=2026-01-01T00:00:00Z&
  end=2026-01-07T00:00:00Z&
  action=auth.*&
  limit=100

Authorization: Bearer YOUR_API_KEY

Response:

{
  "data": [
    {
      "id": "log-123",
      "timestamp": "2026-01-06T10:30:00Z",
      "actor": {...},
      "action": "auth.login",
      "result": "success"
    }
  ],
  "meta": {
    "total": 1500,
    "page": 1,
    "per_page": 100
  }
}

Retention & Compliance

Retention Periods

Tier	Retention
Professional	90 days
Enterprise	1 year (configurable)

Extended Retention

Enterprise customers can configure:

• Standard: 1 year
• Extended: 3 years
• Compliance: 7 years

Additional storage fees may apply.

Compliance Standards

Audit logging helps with:

Standard	How TwinEdge Helps
SOC 2	Complete access logging
ISO 27001	Security event tracking
GDPR	Data access records
HIPAA	PHI access logging
FDA 21 CFR Part 11	Electronic signatures

Immutability

Audit logs are:

• Write-once (cannot be modified)
• Cryptographically signed
• Stored in tamper-evident format
• Backed up to separate storage

Alerts on Audit Events

Security Alerts

Configure alerts for suspicious activity:

1. Go to Settings → Audit Log → Alerts
2. Create alert rules:

Multiple Failed Logins:

{
  "name": "Brute Force Detection",
  "condition": "auth.login_failed > 5 in 10 minutes",
  "group_by": "actor.email",
  "severity": "critical",
  "notify": ["security@company.com"]
}

Unusual Data Export:

{
  "name": "Large Data Export",
  "condition": "data.export AND metadata.row_count > 100000",
  "severity": "warning",
  "notify": ["compliance@company.com"]
}

Admin Actions:

{
  "name": "Admin Activity",
  "condition": "action:role.* OR action:user.deleted",
  "severity": "info",
  "notify": ["admin@company.com"]
}

Real-time Notifications

Receive alerts via:

• Email
• Slack
• Microsoft Teams
• PagerDuty
• Custom webhook

Best Practices

Security Monitoring

1. Monitor failed logins: Alert on brute force attempts
2. Track admin actions: Review all elevated privilege usage
3. Watch data exports: Monitor for unusual data access
4. Review API key usage: Track automated access patterns

Compliance Auditing

1. Regular reviews: Weekly review of security events
2. Access reviews: Monthly review of data access patterns
3. Change tracking: Document all configuration changes
4. Retention management: Ensure logs meet compliance requirements

Operational Visibility

1. Track deployments: Monitor OTA and configuration changes
2. User activity: Understand usage patterns
3. Error tracking: Identify recurring issues
4. Performance insights: Correlate with system metrics

Troubleshooting

Missing Logs

If expected logs aren't appearing:

1. Check time range filter
2. Verify event category is logged
3. Check for indexing delays (up to 5 min)
4. Contact support if persists

Export Failures

If exports fail:

1. Check destination connectivity
2. Verify credentials/permissions
3. Check export size limits
4. Review error messages

SIEM Integration Issues

If SIEM isn't receiving logs:

1. Verify endpoint URL
2. Check authentication
3. Test with curl/Postman
4. Review firewall rules

API Reference

Query Audit Logs

GET /api/v1/audit/logs
Authorization: Bearer YOUR_API_KEY

Query Parameters:
- start: ISO8601 timestamp
- end: ISO8601 timestamp
- actor: User ID or email
- action: Event type pattern
- resource_type: Resource type
- result: success|failure
- limit: Max results (default 100)
- offset: Pagination offset

Get Log Entry

GET /api/v1/audit/logs/{id}
Authorization: Bearer YOUR_API_KEY

Export Logs

POST /api/v1/audit/logs/export
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "start": "2026-01-01T00:00:00Z",
  "end": "2026-01-31T23:59:59Z",
  "format": "csv",
  "filters": {
    "action": "auth.*"
  }
}

Next Steps

• SSO Configuration - Authentication logging
• RBAC & Permissions - Permission change tracking
• Multi-Region - Regional data compliance