Audit Logs - Akhara

Overview

Akhara maintains comprehensive audit logs of all actions taken within your organization. Every API call, user action, and system event is recorded with full context for compliance, security investigations, and operational debugging.

Audit logs are a core component of HIPAA compliance. Akhara retains logs for 7 years by default and provides tamper-evident storage with cryptographic verification.

What’s Logged

Event Type	Description	Example
`user.login`	User authentication	SSO login via Okta
`user.logout`	User session ended	Manual logout
`user.invite`	New user invited	Invited [email protected]
`user.role_changed`	Role assignment modified	Changed from Viewer to Reviewer
`user.removed`	User removed from org	Removed user_abc123

Data Access

Event Type	Description	Example
`dataset.created`	New dataset created	Created “Q1 Triage Calls”
`dataset.accessed`	Dataset viewed or queried	Listed samples in ds_xyz
`sample.viewed`	Individual sample accessed	Viewed sample smp_123
`sample.phi_accessed`	PHI fields accessed	Accessed transcript with PHI
`dataset.exported`	Data exported	Exported 500 samples to CSV
`dataset.deleted`	Dataset deleted	Deleted ds_old_test

Evaluation Events

Event Type	Description	Example
`evaluation.created`	Evaluation started	Created eval_abc with 3 evaluators
`evaluation.completed`	Evaluation finished	Completed with 94% avg score
`evaluation.failed`	Evaluation errored	Failed: invalid evaluator config
`evaluation.cancelled`	Evaluation cancelled	Cancelled by user_xyz

Review Events

Event Type	Description	Example
`review.assigned`	Task assigned to reviewer	Assigned 10 samples to dr.smith
`review.submitted`	Review completed	Submitted grade: under-triaged
`review.overridden`	AI score overridden	Changed triage from 85 to 62
`review.escalated`	Case escalated	Escalated to senior reviewer

Administrative Events

Event Type	Description	Example
`project.created`	New project created	Created “Voice Triage v3”
`project.settings_changed`	Project config modified	Updated evaluator weights
`api_key.created`	New API key generated	Created key for CI pipeline
`api_key.revoked`	API key revoked	Revoked compromised key
`webhook.configured`	Webhook added/modified	Added Slack notification

Log Structure

Each audit log entry contains:

{
  "id": "log_8f3k2m9x",
  "timestamp": "2024-01-15T14:32:18.042Z",
  "event_type": "sample.phi_accessed",
  "actor": {
    "type": "user",
    "id": "user_abc123",
    "email": "[email protected]",
    "ip_address": "192.168.1.42",
    "user_agent": "Mozilla/5.0..."
  },
  "resource": {
    "type": "sample",
    "id": "smp_xyz789",
    "project": "proj_triage_v2",
    "dataset": "ds_q1_calls"
  },
  "context": {
    "fields_accessed": ["transcript", "patient_age"],
    "access_justification": "Clinical review assignment",
    "session_id": "sess_m8k2p"
  },
  "org_id": "org_healthcare_inc",
  "environment": "production"
}

Querying Audit Logs

Via SDK

from akhara import Akhara
from datetime import datetime, timedelta

client = Akhara()

# Get recent PHI access events
phi_logs = client.audit.list(
    event_types=["sample.phi_accessed", "dataset.exported"],
    start_time=datetime.now() - timedelta(days=7),
    limit=100
)

for log in phi_logs:
    print(f"{log.timestamp}: {log.actor.email} - {log.event_type}")

# Get all actions by a specific user
user_activity = client.audit.list(
    actor_id="user_abc123",
    start_time=datetime.now() - timedelta(days=30)
)

# Get events for a specific resource
sample_history = client.audit.list(
    resource_type="sample",
    resource_id="smp_xyz789"
)

Via API

curl "https://api.akhara.ai/v1/audit/logs?event_type=sample.phi_accessed&limit=50" \
  -H "Authorization: Bearer rb_live_xxxxxxxx"

Via Dashboard

Navigate to Organization Settings → Audit Logs to access the visual log explorer with:

Full-text search across all log fields
Filtering by event type, user, resource, and time range
Export to CSV/JSON for compliance reporting
Real-time streaming for active monitoring

Retention & Storage

Plan	Retention Period	Storage	Export
Starter	90 days	Standard	CSV
Pro	1 year	Standard	CSV, JSON
Enterprise	7 years (configurable)	Tamper-evident	CSV, JSON, SIEM

Tamper-Evident Storage

Enterprise audit logs use append-only storage with cryptographic chaining:

# Verify log integrity
verification = client.audit.verify_integrity(
    start_time="2024-01-01T00:00:00Z",
    end_time="2024-01-31T23:59:59Z"
)

print(f"Logs verified: {verification.valid}")
print(f"Chain hash: {verification.chain_hash}")
print(f"Entries checked: {verification.entry_count}")

SIEM Integration

Export audit logs to your Security Information and Event Management system:

Splunk

Native integration via HTTP Event Collector

Datadog

Log forwarding with custom parsing rules

Sumo Logic

Hosted collector integration

Custom Webhook

Real-time forwarding to any endpoint

Configure SIEM Export

# Set up Splunk integration
client.audit.configure_export(
    destination="splunk",
    config={
        "hec_endpoint": "https://splunk.example.com:8088",
        "hec_token": "your-hec-token",
        "index": "rubric_audit",
        "source_type": "akhara:audit"
    },
    event_types=["*"],  # All events, or specify a list
    real_time=True
)

Compliance Reports

Generate pre-formatted reports for compliance audits:

# Generate HIPAA access report
report = client.audit.generate_report(
    report_type="hipaa_access",
    start_time="2024-01-01",
    end_time="2024-03-31",
    format="pdf"
)

# Download report
report.download("hipaa_q1_2024.pdf")

Available Report Types

Report	Description	Frequency
`hipaa_access`	All PHI access with user, time, justification	Quarterly
`user_activity`	Complete user action summary	Monthly
`security_events`	Failed logins, key revocations, permission changes	Weekly
`data_lifecycle`	Dataset creation, modification, deletion	Monthly

Alerting

Configure real-time alerts for security-sensitive events:

# Alert on suspicious activity
client.audit.create_alert(
    name="unusual_phi_access",
    description="Alert when PHI accessed outside business hours",
    condition={
        "event_type": "sample.phi_accessed",
        "time_outside": {"start": "09:00", "end": "18:00", "timezone": "America/New_York"}
    },
    channels=["email", "slack"],
    recipients=["[email protected]"]
)

# Alert on bulk exports
client.audit.create_alert(
    name="bulk_export_alert",
    description="Alert on large data exports",
    condition={
        "event_type": "dataset.exported",
        "threshold": {"field": "context.record_count", "operator": "gt", "value": 1000}
    },
    channels=["pagerduty"]
)

Best Practices

Regular Review

Review audit logs weekly for anomalies and unauthorized access attempts

SIEM Integration

Forward logs to your SIEM for centralized security monitoring

Retention Policy

Configure retention to meet regulatory requirements (7 years for HIPAA)

Alert Configuration

Set up alerts for PHI access, failed logins, and permission changes

Role-Based Access Control

Configure who can access what

Audit & Provenance APIs

Programmatic access to audit logs

​Overview

​What’s Logged

​User Actions

​Data Access

​Evaluation Events

​Review Events

​Administrative Events

​Log Structure

​Querying Audit Logs

​Via SDK

​Via API

​Via Dashboard

​Retention & Storage

​Tamper-Evident Storage

​SIEM Integration

Splunk

Datadog

Sumo Logic

Custom Webhook

​Configure SIEM Export

​Compliance Reports

​Available Report Types

​Alerting

​Best Practices

Regular Review

SIEM Integration

Retention Policy

Alert Configuration

​Related

Role-Based Access Control

Audit & Provenance APIs

Overview

What’s Logged

User Actions

Data Access

Evaluation Events

Review Events

Administrative Events

Log Structure

Querying Audit Logs

Via SDK

Via API

Via Dashboard

Retention & Storage

Tamper-Evident Storage

SIEM Integration

Configure SIEM Export

Compliance Reports

Available Report Types

Alerting

Best Practices

Related