Evidence an auditor can trust

When an auditor asks what happened, "we think" is not an answer. Evidence an auditor can trust records what was detected, why it matched, who did it, where the data was going and what the system did. It is signed, so it cannot be quietly changed afterwards, and it is held somewhere with clear rules about who may read it. Everything else is a story.

Why logs are not enough

Most organizations have plenty of logs. What they often lack is an answer. A log line says a file moved. It rarely says what the file was, why anyone should care, or what the policy was at the time.

An audit question is usually narrower than the data you have. Who sent this contract out, and were they allowed to? What did you do about it? How do you know the record is complete? Six systems with partial logs do not answer that. They create a week of work for someone, and a result that still has gaps.

What a useful event contains

A good event answers five questions on one screen.

• What was detected? The file or content, and its label.
• Why did it match? The rule, and the detector behind it: a fingerprint, a validated pattern, a classifier.
• Who did it? The user and the device.
• Where was it going? The channel and the destination.
• What happened? Allowed, warned, asked for a reason, recorded or blocked.

The second question is the one that saves the most time. If a decision can explain itself, an analyst does not have to reconstruct it, and an auditor does not have to take it on trust. "Why it matched" is also what makes false alarms fixable, because you can see the rule that was too broad.

Signed, so it cannot be edited

An audit trail is only worth something if nobody can tidy it up later. That includes administrators, and it includes people with good intentions. Each GuardStance event leaves signed evidence, so what you show the auditor is what actually happened. Access to the audit log is recorded too, which answers the next question an auditor tends to ask.

This changes the conversation. You are no longer asking someone to trust your team. You are showing them a record that does not depend on trust.

Evidence holds sensitive data too

There is a trap here. Evidence about a data leak can contain the data that leaked, so careless evidence handling creates a second exposure. A few rules keep it under control.

Keep copies only when a rule asks for them. Most events do not need the file itself. Capture it as a shadow copy only where the policy calls for it.

Separate seeing from investigating. Role-based access can limit who sees what by channel, action and department. A reviewer role with no access to content lets someone check that the process works without reading what it caught.

Mask what end users see. A person told that their message was stopped does not need the matched value repeated back to them.

Keep content out of the SIEM. Event metadata can go to your SIEM; the sensitive content should not.

Set retention on purpose. By default GuardStance keeps events for 400 days, long enough for a year-on-year comparison, and the audit log for 24 months. Your organization can shorten these periods, and it helps to write down why you chose them.

From events to a case

An auditor rarely wants one event. They want the story of an incident: when it started, what the investigator found, who decided what, and how it ended. Grouping events into a case with a timeline and notes gives them that story, and it gives your own team a way to hand work over.

Period comparisons help too. Being able to show that a kind of event fell after a policy changed is stronger than saying that things improved.

Questions to test your own evidence

Pick a recent incident and try these.

• Can one person, on one screen, say what happened and why it matched?
• Could anyone have edited that record without leaving a trace?
• Who can read the content behind it, and is that written down?
• How long will the record be kept, and why that long?

If these take a week to answer, the auditor will notice. If they take a few minutes, the audit becomes a much shorter conversation.

Read how Investigations keep the evidence together.