Audit & SIEM
Every action is recorded, queryable, and exportable today. Automatic streaming into Splunk or Datadog is designed but not yet built — both states are marked below.
Available today
The audit log is append-only and scoped to your workspace. Entries are never rewritten, and deleting data does not delete its audit trail — purging a workspace leaves the record of what was purged.
Filter to one person, one kind of action, or a date range. Answers "who changed this" and "what shipped last week" without exporting everything first.
Timestamp, actor, action, target, and metadata. This is the file that satisfies "pull the log and show us" in a security review.
Machine-readable JSON of everything — assets, members, settings, audit history. Built for GDPR portability, useful for leaving.
Entry format — today
The export is deliberately flat so it loads anywhere without a parser. Structured detail
lives in meta as JSON, which your SIEM can expand if it wants to.
actor is always a person or a token, never a serviceaction uses a stable verb vocabularytimestamp_utc,actor,action,target,meta
2026-08-10T09:14:22Z,sarah@acme.com,asset.approved,
pricing-objection-handler,{"version":5}
2026-08-10T09:14:24Z,sarah@acme.com,deployment.run,
target-claude-prod,{"assets":12,"machines":31}
2026-08-10T09:31:07Z,admin@acme.com,member.role_changed,
dan@acme.com,{"from":"editor","to":"approver"}
The committed design, so you can plan against it.
Endpoint, token, index, and sourcetype. Batched, compressed, retried.
API key, site, and tags. Arrives as structured logs with searchable attributes.
Any collector that accepts JSON over HTTPS, with custom headers.
Delivery: batched every 30 seconds or 500 events, whichever comes first. If your collector is unreachable we buffer for 24 hours and retry with backoff. The audit log inside untactit is unaffected either way — streaming is a copy, never a move.
Schema: the streamed form adds source_ip,
user_agent, and result to the five columns
above, and nests actor and target as objects. Those three fields are not captured today.
Every action that changes state or reads sensitive data.
| Category | Actions |
|---|---|
| Authentication | Sign-in, sign-out, session expiry, SSO configuration changes |
| Access control | Role granted, role revoked, invitation sent and accepted, member removed |
| Asset lifecycle | Created, updated, proposed, approved, rejected, archived, restored |
| Deployment | Planned, run, drift detected, drift resolved |
| Configuration | Target connected or removed, approval policy changed, plan changed |
| Data access | Export requested, audit log queried, workspace purged |
Ninety days on Free, one year on Team, three years on Enterprise, extendable by contract where a regulator requires longer. Forwarding to your own system is how you keep it longer than your plan allows.
No. It is append-only, and purging a workspace explicitly preserves it — the deletion itself becomes an entry. Removing audit history requires a separate retention procedure.
No, and that is deliberate. A purge that erased its own record would defeat the purpose of having one. Data is removed; the record that it was removed stays.
Yes, admin only, and querying the audit log is itself an audited action.
Connect one workspace and see every skill, rule, and memory your team has in play — in about ten minutes.
No credit card. Works with what you already run.