Audit Log

The audit log provides a complete record of all actions in your Keva workspace. Essential for security monitoring, compliance, and incident investigation.

Overview

Keva logs:

All user actions (CRUD operations)
Authentication events
API access
System events
Security incidents

Accessing the Audit Log

Navigate to Settings > Security > Audit Log. Requires audit.view permission.

Event Structure

Each audit event includes:

Field	Description
Timestamp	When the event occurred (UTC)
Actor	User or system that performed the action
Action	What was done (e.g., `ticket.created`)
Resource	Type and ID of affected resource
Severity	Event severity (low, medium, high, critical)
IP Address	Source IP of the request
User Agent	Browser/client information
Metadata	Additional context

Event Categories

Ticket Events

Event	Description
`ticket.created`	New ticket created
`ticket.updated`	Ticket properties changed
`ticket.deleted`	Ticket deleted
`ticket.assigned`	Ticket assigned to agent
`ticket.status_changed`	Status updated

Authentication Events

Event	Description
`auth.login_success`	Successful login
`auth.login_failure`	Failed login attempt
`auth.logout`	User logged out
`auth.session_expired`	Session timed out
`auth.mfa_enabled`	MFA activated
`auth.mfa_disabled`	MFA deactivated

Team Events

Event	Description
`team.member_invited`	Invitation sent
`team.member_removed`	Member removed
`team.role_changed`	Role assignment changed

Connector Events

Event	Description
`connector.created`	New connector added
`connector.credentials_accessed`	Credentials retrieved
`connector.credentials_updated`	Credentials changed
`connector.deleted`	Connector removed

Security Events

Event	Description
`security.suspicious_activity`	Anomalous behavior detected
`security.rate_limit_exceeded`	Rate limit triggered
`security.ssrf_blocked`	SSRF attempt blocked
`security.authorization_failed`	Permission denied

API Events

Event	Description
`api_key.created`	New API key generated
`api_key.deleted`	API key revoked
`api_key.used`	API request (sampled)

Filtering the Log

By Date Range

Select a date range to view events:

Last 24 hours
Last 7 days
Last 30 days
Custom range

By Actor

Filter by user:

Specific user email
System actions
API key identifier

By Event Type

Filter by action prefix:

ticket.* - Ticket events
auth.* - Authentication
security.* - Security events

By Severity

Filter by severity level:

Low - Normal operations
Medium - Notable actions
High - Sensitive operations
Critical - Security alerts

Event Severity

Automatic Classification

Events are automatically classified:

Severity	Examples
Low	Ticket viewed, search performed
Medium	Ticket created, settings changed
High	Credentials accessed, bulk operations
Critical	Security events, data exports

High-Risk Events

These events trigger alerts:

connector.credentials_accessed
api_key.created
api_key.deleted
team.member_removed
security.*
Bulk data exports

Exporting Audit Data

Export for Analysis

Apply filters to narrow results
Click Export
Select format (CSV or JSON)
Download file

Exports are logged as audit_logs.exported.

Export for Compliance

For SOC 2 evidence:

Go to Security > Compliance
Click Generate Evidence Report
Select report type
Download signed report

Retention Policy

Default Retention

Standard plans: 90 days
Enterprise plans: Customizable

Archival

For SOC 2 compliance, logs are archived:

Daily archival to encrypted S3 bucket
HMAC-SHA256 signed for integrity
7-year retention for compliance

Real-Time Alerting

Slack Integration

High-risk events trigger Slack notifications:

Configure webhook in Settings > Security
Select alert types
Receive instant notifications

Alert Contents

[SECURITY ALERT] connector.credentials_accessed
Tenant: your-workspace
Actor: user@example.com
Resource: platform_connector/abc123
IP: 203.0.113.45
Time: 2026-03-24T10:15:00Z

Permission Requirements

Action	Required Permission
View audit logs	`audit.view`
Export audit data	`audit.export`