kosa8 docs

Commands / kosa8 audit

kosa8 audit

Inspect what was done, by whom

Every state-changing action is appended to a hash-chained log at ~/.kosa8/audit.jsonl, tagged with whether a human or an agent did it. kosa8 audit verify proves the log has not been edited.

kosa8 audit forward ships it to a SIEM, and kosa8 audit prune applies local retention without breaking the chain; kosa8d does both on its own once ~/.kosa8/audit-config.json configures them.

Subcommands

kosa8 audit exportExport the full audit log for a SIEM (--format jsonl|cef) kosa8 audit forwardShip audit entries to the configured SIEM sinks (syslog, Splunk HEC, HTTPS) kosa8 audit lsShow recent audited actions kosa8 audit pruneApply the retention policy now: seal old entries and remove them from the live log kosa8 audit statusShow where audit entries are forwarded, how far each sink has got, and retention kosa8 audit verifyCheck that the audit log has not been altered