Workspace

Audit log

Immutable history of sign-ins, configuration changes, and PHI-touching actions.

Immutable event store

Records are append-only with nightly hash chaining (00:00 UTC). Tamper detection alerts to Security; retention per policy below.

Events (24h)

18.4k

Ingested

PHI actions

312

Reviewed

Failed auth

14

Flagged

Retention

7 yr

Policy

Audit events

Search and quick-filter the demo append-only window

Showing 14 of 14

Quick filter
Timestamp (UTC)Event IDActorActionResourcePHIOutcomeCorrelation
2026-04-03 14:22:01evt-9c2f1amorgan.reyesVIEWPatient device context · DEV-2041 · ICUPHISuccesscorr-77aa9012
2026-04-03 14:18:44evt-9c2e88systemCONFIG_CHANGEIntegration · HL7 ADT endpoint · prod-eastSuccesscorr-system-441
2026-04-03 14:05:12evt-9c2d10j.patelEXPORTWork order packet · WO-44790 (PDF)PHISuccesscorr-export-8821
2026-04-03 13:51:03evt-9c2b9cc.liuLOGINSSO · Okta · SAMLSuccesscorr-auth-aa01
2026-04-03 13:48:22evt-9c2a40unknownLOGIN_FAILEDSSO · Okta · IP 10.44.12.88Failurecorr-auth-fail-903
2026-04-03 13:40:19evt-9c28f1a.morganUPDATEMaintenance record · PM-8821 · signed closeoutSuccesscorr-pm-2210
2026-04-03 13:22:08evt-9c2766s.riveraVIEWLab interface queue · DEV-6120 · no PHI payloadSuccesscorr-view-lab-12
2026-04-03 12:58:41evt-9c25ddp.shahROLE_ASSIGNRBAC · Biomed tier-2 · j.leeSuccesscorr-rbac-771
2026-04-03 12:41:15evt-9c2440d.wrightPRINTDevice service history · DEV-1088 · imagingPHISuccesscorr-print-334
2026-04-03 12:09:33evt-9c22b8api.serviceAPI_ACCESSREST /v1/devices · scope:read:fleetSuccesscorr-api-9ff12
2026-04-03 11:55:00evt-9c2102unknownLOGIN_FAILEDLocal fallback · kiosk-west · 5 failuresFailurecorr-lockout-204
2026-04-03 11:31:27evt-9c1f8ec.okonkwoDOWNLOADAudit sample · PHI redacted CSV · legal hold LH-992PHISuccesscorr-legal-88
2026-04-03 10:44:52evt-9c1e04systemCONFIG_CHANGERetention policy · audit index · 7yr confirmSuccesscorr-ret-01
2026-04-03 10:12:18evt-9c1c90j.patelDELETEStale draft WO · WO-DRAFT-9912 · soft-deleteSuccesscorr-del-wo-9912