Managing Audit Records Overview

Overview

Audit record management covers notes, tags, reviewed status, bulk actions, archiving, restoring, and purging logs.

Core rule

Manage metadata around the audit record. Do not rewrite the original audit evidence.

Allowed metadata actions

• Add notes.
• Add or remove tags.
• Mark as reviewed.
• Archive records.
• Restore archived records.
• Purge records according to policy.

Original evidence that should stay read-only

• Performed by user.
• Action type.
• Entity type and ID.
• Timestamp.
• IP address and country.
• Old and new values.
• Original event payload.

Example

A deletion event is reviewed and confirmed as approved. The admin adds a note and tags it as resolved, but does not edit the original deletion event.

Screenshot