BUSINESS · AUDIT TRAIL EXPORT

Audit Trail Export

One pack. Audit-ready. Every event HMAC-SHA256 signed and chained to its predecessor. A single tampered row stands out instantly.

What used to take auditors weeks of digging — becomes one file in under a minute.

What's in the pack

summary.html

Printable executive summary — event counts, denial rate, breakdown by type, SOC mapping.

events.json

Full event array with HMAC-SHA256 per event and parent_hmac chaining for tamper detection.

receipt-chain.csv

Tabular form of the same chain — opens cleanly in Excel / Sheets / a SIEM ingestion pipeline.

manifest.txt

Per-file SHA-256 hashes + chain head + verification instructions. Sign this with your KMS to anchor the pack.

Organization ID (sample)

Period (days)

How to verify the pack hasn't been tampered with

Open events.json. Every record carries an hmac and parent_hmac.
Recompute HMAC-SHA256 over [ts | event_type | actor | resource | result | parent_hmac] with your org HMAC secret — must match.
Record N's parent_hmac must equal record N-1's hmac. Modify any row → chain breaks downstream.
manifest.txt carries each file's SHA-256 + the chain head. Sign it with your KMS to anchor the pack in time.

Beta — sample data shown. In production: the pack contains real events from your organization's nd_protect_receipts and nd_proof_events tables, signed with a per-org HMAC derived from KMS. Business subscription and above.

BUSINESS · AUDIT TRAIL EXPORT