Audit logging
Use the audit log three ways, as the evidence an auditor asks for, as the answer to who did this, and as the record you reconstruct an incident from.
5 lessons. 1 quiz.
Read in order, or jump to what you need.
What's logged
By the end of this lesson, you will be able to identify what the audit log captures and what it deliberately excludes, explain the mutations-only design choice, and describe the per-event payload that lands in storage.
Request and response body capture
By the end of this lesson, you will be able to read a captured request/response body in the audit log, predict which bodies are stored, dropped or truncated, and decide what to do when your data policy forbids storing payloads.
Filtering, sorting, exporting
By the end of this lesson, you will be able to construct an audit-log query that answers a specific forensic or compliance question, sort and paginate efficiently for large result sets, and export the filtered view for SIEM or audit consumption.
Audit as compliance evidence
By the end of this lesson, you will be able to map ZopNight audit-log queries to specific SOC 2 and ISO 27001 controls, collect reproducible evidence on demand, and recognize the boundary between what the audit log proves and what supplementary evidence is needed.
Async exports and their guarantees
By the end of this lesson, you will be able to explain why exports run asynchronously, compare the crash-recovery model of the three export surfaces, and read the recommendation workbook without misreading its de-duplicated totals.
Module quiz.
Take it once the lessons are done.