An audit log is only useful if it cannot be modified after the fact. For security operations and compliance purposes, the distinction between a mutable log and an immutable one is significant: a mutable log tells you what happened unless someone changed it, while an immutable log tells you what happened.
What makes a log immutable ¶
Immutability in a log system means that once a record is written, it cannot be modified or deleted by any user, including administrators. On the Husk Mesh Vault platform, audit log records are written to an append-only store and signed with a platform key at write time. The signature covers the record content and the previous record's hash, forming a chain. Any modification to a record invalidates the chain from that point forward, which is detectable.
What the audit log captures ¶
Every API call to the Husk Mesh Vault control plane generates an audit log record. The record includes the timestamp (UTC, millisecond precision), the authenticated identity (API key ID or SSO user), the endpoint called, the request parameters, the response code, and, for configuration-changing operations, a diff of the previous and new state. SSH login events on managed nodes are also captured if the node is running the Husk Mesh Vault agent.
Exporting to a SIEM ¶
Audit log records are exportable in JSON and CEF (Common Event Format) via a streaming API endpoint. The endpoint supports a `since` parameter for incremental export, which makes it straightforward to integrate with a SIEM using a polling agent. We have tested integration with Splunk and with an open-source ELK stack running on customer infrastructure. The CEF format is compatible with most commercial SIEM products without custom parsing rules.
Immutable audit logs are a foundation, not a complete security programme. They tell you what happened; they do not tell you whether what happened was correct. That interpretation is the work of the security operations team and the compliance review process.