Audit Logging

​

Unified Audit Trail

CaseBender maintains a comprehensive, tamper-evident audit trail that records every significant action across the platform. The audit system is designed to satisfy the most stringent compliance requirements (SOC2 CC7.2, ISO 27001 A.8.15, HIPAA 164.312(b), CMMC AU.L2-3.3.1).

​

What’s Logged

Every audit entry captures:

​

Event Categories

​

Query and Search

The audit trail supports powerful querying:

• Full-Text Search: Search across all audit fields
• Filtered Views: Filter by date range, actor, action type, entity type, and more
• Saved Filters: Save commonly used filter combinations
• Export: Export filtered results in PDF, CSV, or structured JSON
• Scheduled Reports: Configure recurring audit reports delivered via email

​

Audit Integrity

​

Tamper-Evident Hash Chains

CaseBender protects audit log integrity using HMAC-SHA-256 hash chains:

• Each audit entry authenticates its protected fields and the previous entry’s hash with the installation-specific AUDIT_INTEGRITY_SECRET
• This creates an immutable chain — modifying any entry would break the chain
• Integrity verification can detect tampering at any point in the chain
• Verification can be performed on-demand or on a schedule

Entries created before chained auditing was enabled remain visible as legacy, unchained records. Verification reports their count separately and requires every entry created after chain activation to be authenticated.

​

Integrity Key Operations

• Production web, api, and worker processes must receive the same AUDIT_INTEGRITY_SECRET.
• Generate the key once per installation and store it in the deployment’s approved secret manager.
• Preserve it with database and environment backups. Restoring the database without the matching key prevents verification of existing chained entries.
• Do not rotate or regenerate it during routine upgrades, container recreation, rollback, or disaster recovery. Key rotation requires a separately designed chain-version transition.
• Never print the value in deployment logs, support tickets, or audit exports.

​

Integrity Verification

• On-Demand Verification: Administrators can verify audit log integrity at any time
• Scheduled Verification: Automated integrity checks run on a configurable schedule
• Verification Report: Detailed report showing chain integrity status, any gaps, and anomalies
• Alert on Tampering: If integrity verification fails, a security alert is generated immediately

​

SIEM Forwarding

CaseBender forwards audit events to your existing SIEM in real-time for centralized security monitoring.

​

Supported Destinations

​

Forwarding Features

• Multiple Destinations: Forward to multiple SIEMs simultaneously
• Event Filtering: Choose which event categories to forward
• Buffering: Events are buffered during SIEM outages and delivered when connectivity is restored
• Retry Logic: Failed deliveries are retried with exponential backoff
• TLS Encryption: All forwarded events are encrypted in transit
• Health Monitoring: Forwarding health is monitored with alerts on delivery failures

​

Legal Hold

CaseBender includes a legal hold system for litigation preservation:

​

Legal Hold Management

• Hold Creation: Create legal holds with scope, custodians, and preservation requirements
• Scope Definition: Define what data is preserved (cases, alerts, evidence, communications)
• Custodian Management: Track custodians (individuals responsible for preserving data)
• Evidence Preservation: Entities under legal hold are exempt from automated retention/deletion
• Hold Release: Release holds when litigation concludes, with full audit trail

​

Legal Hold Features

​

E-Discovery Support

CaseBender supports the full e-discovery lifecycle:

​

E-Discovery Workflow

1. Request: Receive and track e-discovery requests with deadlines and scope
2. Collection: Collect responsive data from cases, alerts, comments, and audit logs
3. Review: Review collected data in dedicated review sets with tagging and annotation
4. Production: Produce responsive documents in required formats
5. Export: Generate export packages for legal counsel

​

Review Capabilities

• Review Sets: Organize collected data into review sets for efficient review
• Tagging: Tag documents as responsive, privileged, or irrelevant
• Bulk Review: Review multiple items simultaneously with consistent tagging
• Decision Tracking: Track review decisions with reviewer attribution
• Export Formats: PDF, CSV, native format, and structured data packages

​

Data Retention for Audit Logs

Audit logs follow configurable retention policies:

​

Related Documentation

• Security Architecture — How audit logging fits into the security design
• Compliance Overview — How audit logs provide compliance evidence
• Threat Detection — UEBA and SIEM integration