Security audit plane versus HTTP request logs, export APIs, tenant opt-out, correlation enrichment, and SIEM integration gaps stated honestly for SOC 2, ISM, and enterprise security questionnaire reviewers evaluating remote management evidence.
Visual summary before evidence tables below.
Trust evidence
Security audit plane versus HTTP request logs, export APIs, tenant opt-out, correlation enrichment, and SIEM integration gaps stated honestly for SOC 2, ISM, and enterprise security questionnaire reviewers evaluating remote management evidence.
Trustholm maintains two distinct logging planes: security audit for privileged and security-relevant actions, and HTTP request logs for operational visibility. Conflating them creates audit findings-assessors need attributable security events, while operators need request latency and error rates.
Security audit plane: Records publish, approve, execute, IAM changes, signing policy updates, and related categories. Web UI at /audit supports category and local datetime filters. Export via GET /api/audit/export returns JSON or CSV with server-side row caps. Tenant administrators can disable tenant audit writing via Settings → Security (PUT /api/tenant/audit-logging)-document opt-out in your SSP if used.
HTTP request logs: Serilog request logging enriches with tenant_id, tenant_code, and correlation_id when resolved. These logs support chargeback, noisy-tenant detection, and incident triage. They are not a substitute for security audit attribution on script execution.
Export workflow for assessors: 1. Enable tenant security audit logging (default on unless opted out). 2. Scope export by category and UTC window matching review period. 3. Correlate script publish, approval, and execution event sequences. 4. Store in GRC or ticket system with retention matching policy. 5. Document SIEM forwarding architecture-Event Hub/DCR sink shipped; Splunk/Datadog native templates backlog.
Immutability honesty: Application flows append audit rows. Database operators with sufficient privilege could still mutate tables. WORM storage or hash-chain verification is backlog-state this gap when mapping to CC7 or ISM logging controls.
GRC integration patterns: Many teams script weekly exports into Vanta, Drata, or ServiceNow GRC modules. Plan field mapping labor-native connectors are not claimed. Retain export hashes or object-lock storage on your side for integrity narrative.
Operational versus security use cases: Train NOC staff that HTTP logs troubleshoot latency; security audit answers "who changed production script policy." Mixing them in runbooks creates assessor confusion and weakens incident response clarity.
Weekly automated export to immutable object storage for regulated tenants; monthly full-category export for SOC 2 examination windows; ad-hoc export within four hours of sev-1 management-plane incidents. Hash files at ingest to GRC.
When row counts drop week-over-week, investigate audit toggle changes or integration failures before assessors notice. Document SIEM forwarding via shipped Event Hub/DCR sink or interim JSON/CSV pipelines.
Assessor interview tip: Bring side-by-side sample rows from security audit and HTTP logs labeled with purpose statements-reduces time spent explaining dual-plane architecture.
Retention ownership: Contractual log retention is customer-defined-document effective periods in SSP and verify exports span full examination windows including timezone boundaries.
Deliver thirty-minute NOC training distinguishing security audit queries from HTTP log searches. Include quiz with scenario cards: script policy change (security audit), API latency spike (HTTP logs), IAM role change (security audit), 502 error storm (HTTP logs). Reduces misfiled evidence in audit season.
Confirm UTC boundaries, daylight-saving shifts, and tenant audit toggle history before export. Attach timezone methodology memo to GRC upload.
Re-export if examiner extends window after initial submission. Maintain export automation source code in version control with peer review on changes affecting category filters or datetime parsing.
Alert when automation jobs fail twice consecutively-silent export gaps have caused examination surprises for peer MSPs.
Assessor correlation exercises: Provide sample event chains linking IAM role change, signing policy update, and script execution within one UTC window. Label each event ID and category in your methodology memo so external auditors need not reverse-engineer export schema during live sessions.
Chargeback and noisy-tenant use of HTTP logs: Operations teams may use tenant_id enrichment for cost allocation-document this separately from security audit narratives to prevent assessors treating HTTP logs as privileged action proof. Document export owner escalation path in operations handbook with on-call contact rotation.
During audit season, maintain read-only GRC service account dedicated to Trustholm exports-avoid sharing personal admin tokens for automation scripts. Peer-review export filter changes in change advisory board when category taxonomy updates ship in platform releases.
This page describes product capabilities for your control matrix. Trustholm does not hold SOC 2, ISO 27001, IRAP, Essential Eight, CMMC, Cyber Essentials, NIS2, or framework certification badges.
| Topic | Evidence | Status | Notes |
|---|---|---|---|
| Security audit export | GET /api/audit/export with category and datetime filters | Shipped | - |
| Tenant audit opt-out | Settings → Security toggle; PUT /api/tenant/audit-logging | Shipped | - |
| HTTP request logs vs security audit | Separate purposes-document both in deployment | Partial | - |
| Correlation IDs | Serilog enrichment with tenant_id / correlation_id | Shipped | Deployment-dependent forwarding to SIEM |
| Sentinel / Event Hub forwarding | EventHubAuditExportSink (azure_eventhub / azure_dcr); ASIM-mapped JSON | Shipped | Configure via Settings → Security integrations or /api/tenant/audit-sinks |
| Immutable archive handoff | gzip NDJSON batches + manifest for operator WORM upload | Partial | Azure Blob Object Lock / S3 Object Lock is customer-operated |
Categories include admin actions, script lifecycle events, IAM changes, and signing policy updates. Filter in UI or export query params to scope assessor windows. Maintain a category-to-control mapping spreadsheet for repeat audit seasons.
Yes via Settings → Security. When disabled, the writer skips tenant rows. Document this choice in your SSP-many regulated buyers require always-on audit and may treat opt-out as a finding.
HTTP logs capture request metadata for operations. Security audit captures attributable privileged actions. Deployments should forward both appropriately-not merge them into one narrative. Train service desk on which plane to query for which incident type.
Event Hub/DCR audit sinks ship today (azure_eventhub / azure_dcr) with ASIM-mapped JSON and DCR template download. JSON/CSV export remains available for interim pipelines. Splunk/Datadog native templates are backlog.
Serilog enrichment includes correlation_id on HTTP logs. Pair exports with your tracing strategy; full distributed trace UI is deployment-dependent. Define correlation playbook for sev-1 management-plane incidents.
API export applies server-side row caps. For large windows, paginate or split exports by datetime range. Async bulk export is on the architecture backlog. Automate split exports in compliance engineering pipelines.