clevernameHelp Center

Audit Trails

Every action on the Clevername platform is logged with a tamper-evident hash chain. Search, filter, and export audit records for compliance, incident investigation, or routine review.

Key Concepts

What gets logged

Every API call, tool invocation, content scan, auth event, config change, and emergency control activation is recorded as an audit entry. Each entry includes:

  • Timestamp, user ID, and IP address.
  • Action type and target resource.
  • Request and response metadata (or full content, depending on audit mode).
  • A cryptographic hash linking to the previous entry (hash chain).

Audit modes

The guardrail profile controls how much detail is captured:

Full ContentLogs complete request/response payloads. Required for HIPAA.
Metadata OnlyLogs action type, resource, and timing. No payload content.

Hash chain verification

Each audit entry contains a SHA-256 hash that incorporates the previous entry's hash, creating a tamper-evident chain. If any entry is modified or deleted, the chain breaks and verification fails. This provides cryptographic proof that your audit log has not been altered.

Audit trail view showing a filterable table of audit entries with timestamp, user, action, resource, and hash chain status columns
The audit trail provides a searchable, filterable view of every platform action with hash chain verification status.
Step-by-Step Guide
1

Navigate to Audit Trails

Go to Security → Audit Trails in the dashboard sidebar. The default view shows the most recent 24 hours of activity.

Dashboard sidebar with Security section expanded, Audit Trails highlighted
Find Audit Trails under the Security section.
2

Search and filter entries

Use the search bar to find entries by action type, user, resource, or free text. Apply filters to narrow by:

  • Time range — Last hour, 24h, 7 days, 30 days, or custom range.
  • Action type — API call, tool invocation, auth event, config change, etc.
  • User — Filter to a specific user or agent.
  • Severity — Info, warning, error, critical.
3

Inspect an entry

Click any row to expand the entry detail panel. In full contentaudit mode, you'll see the complete request and response payloads. In metadata onlymode, you'll see the action summary without payload content.

Expanded audit entry showing timestamp, user, action details, request/response payloads, and hash chain link
Each entry shows complete context. The hash chain link at the bottom lets you verify chain integrity.
4

Verify the hash chain

Click Verify Chain to run an integrity check across a range of entries. The system recomputes each hash and confirms the chain is unbroken. A green checkmark confirms integrity; a red flag indicates tampering.

5

Export audit data

Click Export to download audit entries as CSV or JSON. Apply filters first to export a specific subset. Exports include the hash chain values for offline verification.

Tip
Schedule recurring exports via the Compliance Reports page to automate audit data delivery to your compliance team.

Retention policy

The default retention period is 365 days. This can be extended per agent via the guardrail profile's retention_days field (set from Agent Review questionnaire item C4). Enterprise plans support unlimited retention.

Related Articles
SOC ConsoleCompliance ReportsCleverGuardSOAR Integration