Activity and audit

Two records that people conflate, and should not.

Activity is what happened in your organization: messages, pull requests, issues, meetings. Evidence.

Audit is what the runtime decided: every action, its verdict, and why. Proof.

The timeline merges them, which is usually what you actually want, the decision, and the conversation that preceded it, in one column.

Two copies, one authoritative

The runtime writes its own hash-chained log on your machines. The console shows a mirror of it, scored for risk and merged with your source events.

The local log stays authoritative. That matters in one situation and it is worth knowing in advance: if the two ever disagree, the machine's copy is the one to trust, and the console tells you when its copy has fallen behind rather than showing you a gap as though it were quiet.

The chain

Every event carries a hash of itself and of the one before it, computed as it is written. Editing or removing a record breaks the chain from that point on, which is what makes the next command meaningful.

memnox audit verify
# Audit chain intact — 128401 events verified.
# …or: Audit chain BROKEN at event #91 (0f3a…): content-mismatch

The same answer as JSON, for a monitor that should check it nightly rather than waiting for somebody to run a command:

curl http://127.0.0.1:7466/v1/audit/verify \
  -H "Authorization: Bearer $MEMNOX_ADMIN_TOKEN"

Sinks, shipping decisions out

Register a destination under Settings → Notifications and every decision is delivered to it as it happens.

An S3 bucket with object lock, or a Kafka topic your security team owns, gives you the property the chain alone cannot: a copy nobody administering Memnox can rewrite.

Export

CSV for the auditor who wants a spreadsheet; the report bundle for the one who wants everything at once. See For compliance and legal.

Retention

Audit retention is set per deployment and pruned on an hourly sweep. The Postgres delete is batched so it never holds a long table lock, and a distributed lock keeps a single pod sweeping at a time.

memnox serve --audit-retention-days 365     # 0 keeps everything

Set it to what your policy actually requires. "Keep everything" is a defensible choice; "we never decided" is not.

Replay and explain

memnox replay <sessionId>     # every decision in one agent session, in order
memnox explain <eventId>      # why this event got this verdict

Because nothing in the decision path is random or model-derived, both are recomputations rather than reconstructions.