Module 9docs/iam/audit-and-compliance
Audit Logging & Compliance Governance
SoldierX AI SIEM maintains an immutable, write-once audit trail capturing every access control alteration, privilege elevation handshake, policy detachment, and evaluation outcome for regulatory compliance and forensic investigations.
Audit Ledger Schema
Every administrative or elevated operational transaction records an immutable structured audit entry:
audit-log-entry-schema.json
{
"auditId": "aud_01HGB8294ZKJ12",
"timestamp": "2026-09-24T17:30:00.000Z",
"actor": {
"userId": "usr_918231",
"email": "lead-analyst@commandonetworks.com",
"assumedRoleId": "role_incident_commander"
},
"action": "iam:role:attachPolicy",
"target": {
"entityType": "role",
"entityId": "role_tier1_soc"
},
"outcome": "SUCCESS",
"reasonTrace": {
"type": "granted",
"byPolicy": "pol_security_admin_full"
},
"networkContext": {
"ipAddress": "198.51.100.45",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)..."
}
}| Field | Type | Description |
|---|---|---|
| auditId | string | Unique monotonic event identifier. |
| actor | object | Contains baseline userId and optional assumedRoleId for full forensic attribution. |
| action | string | The canonical action string attempted by the caller. |
| outcome | "SUCCESS" | "DENIED" | Authorization decision output. |
| reasonTrace | object | Exact evaluation reason, matching policy ID, and rule source. |
Compliance Control Alignment
SoldierX AI SIEM IAM natively satisfies enterprise cybersecurity compliance requirements:
| Framework | Control Identifier | Platform Capability Mapping |
|---|---|---|
| SOC 2 Type II | CC6.1, CC6.2, CC6.3 | Least privilege access boundaries, MFA-enforced temporary role assumption, immutable change audit logs. |
| ISO/IEC 27001:2022 | A.5.15, A.5.18, A.8.18 | Access control rights management, privileged access management (PAM) via time-bounded assumable roles. |
| PCI-DSS v4.0 | Req 7.1, 8.2, 10.2 | Strict need-to-know resource scoping, individual identity attribution (no shared accounts), audit logging. |
| HIPAA Security Rule | § 164.312(a)(1), (b) | Unique user identification, emergency access procedures via Assumable Roles, and complete audit controls. |
Quarterly Access Review Runbook
Security managers should execute this 5-step operational runbook every 90 days:
- Export Identity Matrix: Navigate to
IAM > Team Membersand export the complete list of users, their attached groups, direct policies, and active status. - Identify Inactive Operators: Review users who have not authenticated in 90+ days. Deactivate inactive users using the deactivation toggle to immediately revoke active tokens.
- Audit Assumable Roles & Trust Policies: Verify that destination emails for verification OTPs are distribution lists (
soc-leads@company.com) rather than personal addresses, and confirm that IP allowlists reflect current corporate egress gateways. - Prune Orphaned Inline Policies: Inspect inline policies on departed users and convert recurring exception policies into reusable Managed Policies.
- Generate Verification Checksum: Export the audit log trail for the quarter and record its cryptographic SHA-256 hash in your compliance binder.
Audit Export & Verification
Audit logs can be exported directly from the IAM console via iam:audit:read in structured JSON format. Each exported package includes a digital signature header for non-repudiation.
RETENTION POLICY
SoldierX AI SIEM stores audit log events in high-performance hot storage for 365 days. Enterprise tiers support automated streaming to external S3/GCS immutable compliance vaults for long-term retention.