Skip to content
Browse the docs

Audit Log and Audit Streaming

See every change to your company in the Kalima Console, filter and export it, and stream new entries to your SIEM on Enterprise.

The Audit log lists every change to your company in Kalima: who, what, when and from where. Entries can be neither changed nor deleted. Changes made by Kalima and by Kalima support are listed too.

Owners, admins and Auditors open it. On Enterprise, a custom role with Read the audit log can too.

What an entry shows

  • Time, Who (a person, Kalima, the system, SCIM, Kalima support with the staff member's name, or an API key with its name), Action, Concerns and Result (Succeeded or Refused).
  • Origin: IP address, device with browser and operating system, and country.
  • Show details: the values before and after the change.

The log covers areas such as members, ownership, teams, policies, billing, sign-in and security, domains, SSO, SCIM, API keys, webhooks, legal holds, Kalima support access, custom roles and the audit log itself. Opening a member's sign-in history and every company export are recorded too.

Filter

Use Filters to narrow the list:

  • Period: last 24 hours, 7, 30, 90 or 365 days.
  • Person, Area, Action and Result.

Export

Choose As CSV or As JSON to export the entries that match your filters, up to 10,000 entries per export.

How far back you can see

PlanEntries shown
TeamThe last 90 days
EnterpriseThe last 365 days

Kalima stores entries for 13 months and deletes them after 14 months at the latest.

Audit streaming (Enterprise)

Audit streaming sends new audit log entries to your SIEM as they happen. Open Audit log and choose Audit streaming. Owners and admins set it up.

1
Choose Add destination and pick the Type: HTTPS webhook or Splunk HEC.
2
Enter a Name and the Address. For Splunk, also the HEC token and, if you like, an Index (optional). Without a path, Kalima adds /services/collector/event.
3
For a webhook, copy the signing secret. Kalima shows it only once.
4
Choose Test to send a single test event.

Details:

  • Up to 3 destinations per company. Only public HTTPS addresses on port 443 or a port from 1024; Kalima does not follow redirects.
  • New entries usually arrive within one to two minutes. A new destination receives every entry from the moment you add it.
  • Webhook: a POST with JSON and at most 100 entries, in time order. Every request carries the Kalima-Signature header with a timestamp and an HMAC-SHA256 signature that you check with your secret. Create new secret replaces it.
  • Splunk: one event per line to the HTTP Event Collector, sourcetype kalima:audit, with your token.
  • Each entry has the same fields as the JSON export, with the complete IP address.
  • Kalima delivers every entry at least once; duplicates can be told apart by their event_id.
  • If the receiver does not answer with a 2xx status, Kalima retries at growing intervals of up to 15 minutes. After 24 hours of failures it pauses the destination. When you Resume it, every entry since the pause follows.

Your company decides who sees the streamed entries in its own system and how long they stay there.

Privacy and works council
What the administration sees and how long Kalima keeps it.
Support access
Kalima support's actions in the audit log.