About Auditability, logging and compliance

Prev Next

Centralized and Immutable Logging

The User Behavior module of the Segura platform records all relevant events of the privileged session lifecycle and user activities in a centralized and immutable log. This includes:

  • Session actions: start, end, duration, executed commands, viewed credentials, user switches, used devices, and context changes.
  • Behavioral events: anomaly detection, activated triggers, executions of adaptive responses (e.g., MFA, session blocking).
  • Automated responses: every decision of the Behavior Engine—alerts, policy enforcement, integrations with SIEM/SOAR—is recorded with a timestamp and detailed context.

All logs are protected against unauthorized modifications, with integrity verification mechanisms (hashing, digital signatures) and configurable retention according to compliance policies (e.g., SOX, GDPR, LGPD).

Visibility & Searchability

  • Detailed query: intuitive interfaces allow for quick searches by any action, user, session, or trigger, including filters by event type, risk, time, origin/device, and response status.
  • Interactive dashboards: advanced visualizations show trends, risk hotspots, critical sessions, user behavior, and incident evolution.
  • Forensic drill-down: allows for detailed (forensic) investigation of incidents, correlating multiple events and sessions to reconstruct a chain of suspicious actions or violations.

Export & Integration

  • Secure export: logs can be exported in standard formats (CSV, JSON, syslog, CEF, etc.) for integration with SIEM, auditing platforms, or forensic analysis systems. APIs and webhooks allow for export automation, real-time sending to external tools, and orchestration of personalized compliance and investigation workflows.
  • Native integration: Behavior Engine logs can be consumed by external platforms via plug-and-play integrations (Splunk, QRadar, ArcSight, Elastic, etc.).