Audit

The Audit page in LEA Platform has two views:

• Webhook Audit: compliance state changes of hosts and webhook deliveries.
• System Audit: every administrative change in the database, plus ad-hoc commands sent from Live Execution.

Retention is set in Settings → Data Retention.

Webhook Audit

Summary: Total Entries, Webhook Events, Compliance Events, Success Rate.

Expand a row to see the request data, with current and previous state:

{"curr_state": {"compliance": true, "managed": true}, "prev_state": {"compliance": null, "managed": true}}

Filters: host name search; event type (All Events, Webhook Events, Compliance Events).

System Audit

Recorded at database level. Summary: Total Entries, Inserts, Updates, Deletes.

Expand an UPDATE to see a diff: removed values in red, added values in green.

"cmd_id": [
-  []
+  [ 132 ]
]

Filters: search by actor or request ID; action type.

Enrollment events (re-enrollment windows opened, used or closed, key-proof recovery, conflicts, confirmations) are also written here.

Common uses

• Compliance check-ins: filter Compliance Events to see hosts going from compliant to non-compliant.
• Incident review: list admin changes around the time of an incident; use Request ID to group them.
• Change management: see who changed a group, rule or setting, and exactly what changed.
• Agent health: hosts that stop producing events may have network or agent problems.

Good practice

• Review audit entries regularly.
• Watch the Webhook Success Rate for delivery problems.
• Match System Audit entries to your change tickets.
• Set retention to match your policy, and export audit data if you need to keep it longer.