> ## Documentation Index
> Fetch the complete documentation index at: https://docs.summand.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit logs

> Every authentication, authorization, and configuration event — viewable in WorkOS, streamed to your SIEM.

Summand's audit trail covers two surfaces:

| Surface                | Where it lives                    | What it covers                                                                                    |
| ---------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Identity events**    | WorkOS Admin Portal + Log Streams | Sign-ins, MFA challenges, SSO connection changes, SCIM provisioning, role changes, session events |
| **Application events** | Summand AWS CloudWatch            | Dataset creation, sharing changes, view and experiment edits, analysis runs, PDF exports          |

Both are retained for **6+ years** to meet HIPAA requirements, and both are queryable.

## Viewing identity audit logs

From **Settings → Organization → Audit Logs → Configure** in Summand. The link opens a one-time WorkOS Admin Portal session pointed at the audit log viewer.

Every event has:

* Timestamp (UTC)
* Actor (user ID, email, IP address, user agent)
* Event type (`user.signed_in`, `connection.activated`, `sso.session_created`, etc.)
* Result (success / failure)
* Context (which org, which connection, which target)

You can filter by date range, event type, actor, and result.

## Streaming to your SIEM

For real-time monitoring and longer retention, forward events to your SIEM via **Log Streams**:

<Steps>
  <Step title="Open Log Streams">
    **Settings → Organization → Log Streams → Configure**.
  </Step>

  <Step title="Pick a destination">
    Datadog, Splunk, AWS S3, or generic HTTPS webhook are supported.
  </Step>

  <Step title="Configure the destination">
    Provide the API key / endpoint URL the destination requires. The portal validates the connection before saving.
  </Step>

  <Step title="Verify events arrive">
    Sign in or trigger a test event; you should see it in your SIEM within 30 seconds.
  </Step>
</Steps>

A common pattern: route events to S3 for long-term archive *and* to Datadog for real-time alerting. Multiple log streams can run in parallel.

## What to alert on

Suggested alerting rules:

* **Spike in failed logins** (`user.signed_in_failed`) from a single IP
* **Multiple SSO connection changes** (`connection.activated`, `connection.deactivated`) outside change windows
* **Unexpected role escalations** (`organization_membership.role_changed` to admin or owner)
* **MFA factor deletions** (`authentication_factor.deleted`)
* **SCIM provisioning failures** (`directory.sync_failed`)

## Application-level audit (Summand-side)

In addition to identity events, Summand logs application events to CloudWatch:

| Event                                       | What's logged                              |
| ------------------------------------------- | ------------------------------------------ |
| Connector created / updated / deleted       | Actor, kind, connector ID                  |
| Dataset created / updated / deleted         | Actor, dataset ID, source connector        |
| View created / updated / deleted            | Actor, view ID, name                       |
| Experiment created / updated / deleted      | Actor, experiment ID, components, schedule |
| Experiment run started / completed / failed | Actor, experiment ID, run ID, status       |
| Share grant added / changed / revoked       | Actor, target user, role                   |
| Visibility change                           | Actor, dataset ID, before / after          |
| Analysis run started / completed / failed   | Actor, dataset ID, version                 |
| PDF export                                  | Actor, dataset ID, version                 |

Enterprise customers can request these forwarded to their SIEM via the same Log Streams plumbing — contact support to enable.

## Retention

| Surface                             | Retention                                              |
| ----------------------------------- | ------------------------------------------------------ |
| Identity audit logs (WorkOS)        | 6 years                                                |
| Application audit logs (CloudWatch) | 6 years (Enterprise), 1 year (other tiers)             |
| User sign-in sessions               | Managed by WorkOS; configurable per-org for Enterprise |

Six-year retention satisfies HIPAA's audit requirement. ISO 27001 and SOC 2 audits accept the same retention period.

## Compliance and legal hold

For litigation hold or regulatory retrieval requests:

* The WorkOS audit log can be exported via the portal in CSV or JSON.
* CloudWatch logs can be exported via your AWS account if Enterprise log forwarding is set up; otherwise, contact Summand support and we'll export for you within 5 business days.