TigerTrust writes an audit event for every action that changes state — issuances, revocations, deployments, workflow runs, approvals, config changes, logins, and role edits. The audit trail is the single source of truth for compliance evidence (SOC 2, ISO 27001, PCI-DSS, HIPAA) and post-incident forensics.
Audit Logs

​
What it is

Every audit entry records who did what to which resource and when, including the source IP and user agent. Entries are append-only — there is no way to edit or delete them through the product. You can filter the log, export it in multiple formats, and stream it to a SIEM.

​
When to use it

  • Prove to an auditor exactly who issued production certificates in the last quarter.
  • Reconstruct the sequence of events during a security incident.
  • Export a slice of the audit log as a PDF to attach to a compliance report.
  • Stream events to Splunk, Datadog, or Elastic in real time.

​
Set it up

No setup is required — audit logging is always on. Go to Audit logs in the main navigation to query and export.

​
What you’ll see

Each entry in the audit log contains:
FieldDescription
ActorUser, service account, system, or agent
ActionVerb: create, update, delete, approve, execute, deploy, export, login, and others
Resource typeObject class: certificate, workflow, approval, alert, notification channel, and others
ResourceThe specific record that was affected
DetailsStructured payload with before/after values or parameters
IP addressSource IP of the actor
TimestampServer-side time
Filter by actor, action, resource type, or date range. The filter URL updates so you can bookmark a specific view.

​
Exporting

Three formats are available for compliance evidence and SIEM ingest:
One row per event, all fields flat. Ideal for spreadsheet review.
Export requests are themselves audit-logged so you can prove who pulled which slice of history.

​
Streaming to a SIEM

Point a webhook notification channel at your SIEM endpoint and create a workflow that fires on audit events. Payloads are signed with HMAC-SHA256 so the SIEM can verify origin. Splunk, Datadog, Sumo Logic, and Elastic all accept this shape.

​
Common queries for compliance

Filter by action create and resource type certificate, then narrow by date range. Check the details field for certificates tagged prod.
Filter by action revoke and resource type certificate. The details field contains the RFC 5280 reason code and any human-entered justification.
Filter by resource types role and user_role_binding to see every grant, revocation, and role edit.
By default, audit log entries are retained indefinitely. For regulated estates, apply a retention policy — archive entries older than your required retention period to cold storage before deletion.
The API surface for querying and exporting audit logs is documented at API Reference.

Alerts

Fire an alert on audit patterns that should not happen.

Reports

Schedule compliance PDFs sourced from audit data.