Audit - Features

📋 Description

The Audit Log delivers end‑to‑end transparency for every object’s lifecycle: who did what, when, and in which context, covering creation, edits, status changes, checkout/check‑in, deletion, and restore.

💎 Business Value

Enables compliance‑grade traceability, accelerates investigations, and reduces operational risk through standardized, immutable records and retention/archival aligned to regulatory needs. Stakeholders gain confidence that decisions are auditable, changes are reconstructable, and accountability is clear across versions and language variants.

🗺️ Roadmap Features (5)

Checkout & check‑in Logging

Clear accountability for editing sessions, recording lock ownership, check‑in context, and prevention of duplicate/blocked actions.

Lifecycle event recording

Automatic capture of create, delete, and restore events with actor, timestamp, and identifying context for complete lifecycle endpoints.

Metadata change tracking

Granular field-level before/after details, grouped per update action, with explicit null handling and omission of unchanged fields.

Object audit trail viewer

Unified history view with newest-first ordering, filters (event, actor, date, version/language), pagination, and export for compliance reviews.

Workflow status transitions

From→to tracking across Draft/Review/Approved/Published, including reversions, to justify release decisions and audit workflow progression.

✓ Merged to main

🕐 Development time: 3d-03h-18m⏱ Time to deployment: 0d-00h-01m

📋 Development Summary

Summary: This work delivers the core audit logging foundation by introducing the 019 audit log specification and extending it with a unified audit event model and security-specific event types. The implementation establishes a standardized approach to capturing, retaining, and archiving audit data, providing a consistent framework for compliance, monitoring, and security analysis. Key Changes: - Added the 019 audit log specification with configurable retention policies. - Introduced tiered archival support for managing audit log storage over time. - Standardized audit event definitions to ensure consistent logging across the system. - Added security event types to improve coverage of security-relevant actions and incidents. - Created a unified audit event model to consolidate how audit records are structured and processed. Impact: These changes strengthen the platform’s auditability and compliance readiness while improving operational visibility into user and system activity. They also provide a scalable foundation for long-term log management and more effective security monitoring.

🔧 API Changes (35 files)

M src/Aleido.Platform.API/Endpoints/ASTSearchEndpoints.cs
M src/Aleido.Platform.API/Endpoints/AccessControlEndpoints.cs
A src/Aleido.Platform.API/Endpoints/AuditEndpoints.cs
M src/Aleido.Platform.API/Endpoints/AzureDevOpsEndpoints.cs
M src/Aleido.Platform.API/Endpoints/BinaryContentEndpoints.cs
M src/Aleido.Platform.API/Endpoints/CheckoutEndpoints.cs
A src/Aleido.Platform.API/Endpoints/ComplianceEndpoints.cs
M src/Aleido.Platform.API/Endpoints/LockEndpoints.cs
M src/Aleido.Platform.API/Endpoints/MetadataAdminEndpoints.cs
M src/Aleido.Platform.API/Endpoints/ObjectApprovalEndpoints.cs
M src/Aleido.Platform.API/Endpoints/ObjectCommentsEndpoints.cs
M src/Aleido.Platform.API/Endpoints/ObjectEndpoints.cs
M src/Aleido.Platform.API/Endpoints/ObjectLocalizationEndpoints.cs
M src/Aleido.Platform.API/Endpoints/ObjectRecentEndpoints.cs
M src/Aleido.Platform.API/Endpoints/ObjectTypeEndpoints.cs
M src/Aleido.Platform.API/Endpoints/ObjectVersionEndpoints.cs
M src/Aleido.Platform.API/Endpoints/PublishEndpoints.cs
M src/Aleido.Platform.API/Endpoints/PublishingEndpoints.cs
M src/Aleido.Platform.API/Endpoints/RoleEndpoints.cs
M src/Aleido.Platform.API/Endpoints/WorkspaceEndpoints.cs
M src/Aleido.Platform.API/Endpoints/WorkspaceRoleEndpoints.cs
A src/Aleido.Platform.API/Extensions/RateLimitingExtensions.cs
M src/Aleido.Platform.API/Extensions/ServiceRegistrationExtensions.cs
M src/Aleido.Platform.API/Extensions/WebApplicationExtensions.cs
A src/Aleido.Platform.API/HttpFiles/audit-compliance.http
M src/Aleido.Platform.API/Middleware/CompressionTelemetryMiddleware.cs
A src/Aleido.Platform.API/Models/Requests/AuditFilterRequest.cs
A src/Aleido.Platform.API/Models/Responses/AuditResponses.cs
A src/Aleido.Platform.API/Models/Responses/IntegrityCheckResponse.cs
A src/Aleido.Platform.API/Models/Responses/SecurityEventResponse.cs
M src/Aleido.Platform.API/README.md
A src/Aleido.Platform.API/Services/Audit/AuditRequestContextAccessor.cs
M src/Aleido.Platform.API/Services/ObjectService.Operations.cs
M src/Aleido.Platform.API/Services/ObjectService.cs
M src/Aleido.Platform.API/docs/openapi.json

📝 Commit Log

d61da6ffe Add security event types and unified audit event model 6e432533e Merge branch 'main' into 019-audit-log 5fa4c20b6 feat(specs): add 019 audit log spec with configurable retention, tiered archival, standardized events

💻 Development Features (7)

Metadata and Property Change Auditing

No description available

Security Event Auditing

No description available

Core Audit Model, Service Infrastructure, and Documentation

No description available

Object Lifecycle Logging

No description available

Object Audit Trail Viewing and Filtering

No description available

Compliance and Archival Services

No description available

Workflow Action Auditing

No description available

📋 Backend Requirements (1)

Related requirement tasks from other projects

✓ 4.20 - Full access to the operation data to do internal/external reporting.

To Do

Description Please provide system capabilities and/or a demo. Platform Status: partially implemented PPT Status: Yes MVP: Yes Must Have: Priority 1 (A) Use Case This will assist in setting and monitoring our KPI's. For example, in WC our workflow and data processing was less efficient than previous CMS. We would like ability to track our progress in the new CCMS (how long it takes to author a topic, how long it is in translation, how long does publishing take, how many iteration reviews took place, from start to finish did we meet 48 hours) to look for areas of efficiency gain or focus areas for improvement as well. Current Challenges Internal reports in current tool are cumbersome and configured for engineering/mfg/parts data reports. Lacks good reports for Technical Information. One specific KPI we have been unable to achieve in current tool and would want to measure is 48 hr update - are we meeting the target, how far off are we. Notes but supported (data available Save a lot of the information in the backend PowerBI does currently work with platform Don't have access yet (Simple to rollout) Custom visualisations need to be implemented (dashboards) Not yet exportable or sent to a dashboard. Description: Allows internal/external reporting, PowerBI integration, and custom visualisations; export/dashboard functions not yet available. Status: Not implemented but supported Notes: Data stored in backend; PowerBI works but no access yet; custom dashboards need implementation; currently not exportable.

View in Azure DevOps →