Unified Audit Trail
CaseBender maintains a comprehensive, tamper-evident audit trail that records every significant action across the platform. The audit system is designed to satisfy the most stringent compliance requirements (SOC2 CC7.2, ISO 27001 A.8.15, HIPAA 164.312(b), CMMC AU.L2-3.3.1).
What’s Logged
Every audit entry captures:
| Field | Description |
|---|
| Timestamp | Precise UTC timestamp of the action |
| Actor | Who performed the action (user, system, integration, or API key) |
| Action | What was done (create, read, update, delete, export, authenticate, etc.) |
| Target | What entity was affected (case, alert, task, user, configuration, etc.) |
| Changes | Before and after values for modifications |
| Context | IP address, user agent, session ID, tenant ID |
| Compliance Flags | Which compliance frameworks this event satisfies |
Event Categories
| Category | Examples |
|---|
| Entity Access | Case viewed, alert accessed, evidence downloaded |
| Entity Changes | Case updated, alert status changed, task assigned |
| Authentication | Login, logout, MFA challenge, SSO assertion, lockout |
| Authorization | Access granted, access denied, privilege elevated, role changed |
| System Events | Service started, configuration changed, backup completed |
| Data Export | Audit log exported, case data exported, report generated |
| Security Events | Anomaly detected, threat indicator triggered, policy violation |
| Bulk Operations | Bulk update, bulk delete, bulk assign (with individual item tracking) |
Query and Search
The audit trail supports powerful querying:
- Full-Text Search: Search across all audit fields
- Filtered Views: Filter by date range, actor, action type, entity type, and more
- Saved Filters: Save commonly used filter combinations
- Export: Export filtered results in PDF, CSV, or structured JSON
- Scheduled Reports: Configure recurring audit reports delivered via email
Audit Integrity
Tamper-Evident Hash Chains
CaseBender protects audit log integrity using cryptographic hash chains:
- Each audit entry includes a SHA-256 hash of the previous entry
- This creates an immutable chain — modifying any entry would break the chain
- Integrity verification can detect tampering at any point in the chain
- Verification can be performed on-demand or on a schedule
Integrity Verification
- On-Demand Verification: Administrators can verify audit log integrity at any time
- Scheduled Verification: Automated integrity checks run on a configurable schedule
- Verification Report: Detailed report showing chain integrity status, any gaps, and anomalies
- Alert on Tampering: If integrity verification fails, a security alert is generated immediately
Audit log integrity verification satisfies SEC Rule 17a-4 (WORM storage equivalent), SOC2 CC7.2 (system monitoring), and ISO 27001 A.8.15 (logging).
SIEM Forwarding
CaseBender forwards audit events to your existing SIEM in real-time for centralized security monitoring.
Supported Destinations
| Destination | Protocol | Formats |
|---|
| Splunk | HTTP Event Collector (HEC) | JSON, CEF |
| Elastic / ELK | Elasticsearch API | JSON (ECS-compatible) |
| IBM QRadar | Syslog (TCP/TLS) | LEEF |
| Microsoft Sentinel | Log Analytics API | JSON |
| Generic Syslog | Syslog (TCP/UDP/TLS) | CEF, LEEF, JSON |
| Custom Webhook | HTTPS POST | JSON |
Forwarding Features
- Multiple Destinations: Forward to multiple SIEMs simultaneously
- Event Filtering: Choose which event categories to forward
- Buffering: Events are buffered during SIEM outages and delivered when connectivity is restored
- Retry Logic: Failed deliveries are retried with exponential backoff
- TLS Encryption: All forwarded events are encrypted in transit
- Health Monitoring: Forwarding health is monitored with alerts on delivery failures
Legal Hold
CaseBender includes a legal hold system for litigation preservation:
Legal Hold Management
- Hold Creation: Create legal holds with scope, custodians, and preservation requirements
- Scope Definition: Define what data is preserved (cases, alerts, evidence, communications)
- Custodian Management: Track custodians (individuals responsible for preserving data)
- Evidence Preservation: Entities under legal hold are exempt from automated retention/deletion
- Hold Release: Release holds when litigation concludes, with full audit trail
Legal Hold Features
| Feature | Description |
|---|
| Automatic Preservation | Entities matching hold scope are automatically preserved |
| Retention Override | Legal holds override data retention policies |
| Custodian Notification | Custodians are notified of their preservation obligations |
| Compliance Tracking | Track custodian acknowledgment and compliance |
| Chain of Custody | Maintain evidence chain of custody documentation |
| Audit Trail | All hold actions are logged in the audit trail |
E-Discovery Support
CaseBender supports the full e-discovery lifecycle:
E-Discovery Workflow
- Request: Receive and track e-discovery requests with deadlines and scope
- Collection: Collect responsive data from cases, alerts, comments, and audit logs
- Review: Review collected data in dedicated review sets with tagging and annotation
- Production: Produce responsive documents in required formats
- Export: Generate export packages for legal counsel
Review Capabilities
- Review Sets: Organize collected data into review sets for efficient review
- Tagging: Tag documents as responsive, privileged, or irrelevant
- Bulk Review: Review multiple items simultaneously with consistent tagging
- Decision Tracking: Track review decisions with reviewer attribution
- Export Formats: PDF, CSV, native format, and structured data packages
Data Retention for Audit Logs
Audit logs follow configurable retention policies:
| Data Type | Default Retention | Compliance Requirement |
|---|
| Authentication events | 3 years | SOC2, ISO 27001, CMMC |
| Authorization events | 3 years | SOC2, ISO 27001, HIPAA |
| Data access events | 3 years | GDPR, HIPAA, PCI DSS |
| Configuration changes | 7 years | SEC Rule 17a-4 |
| Security events | 3 years | SOC2, CMMC, FedRAMP |
| Compliance evidence | 7 years | Multiple frameworks |
Audit logs under legal hold are retained indefinitely regardless of retention policy settings.
