Audit Log

Append-only, hash-chained and written to CloudTrail Lake in Halcyon's GovCloud account.

Immutable · SHA-256 chain verified

Timestamp	ID	Actor	System	Action	Target	Result	Policy rule	Approval ref
Oct 8, 07:27:00 PT	AUD-51200	AI SOC	Strata Cloud Manager	Query DNS Security logs	ENG-WS-202	Info	—	—
Oct 8, 07:24:00 PT	AUD-51201	AI SOC	Cortex XDR	Verdict: True Positive (94%)	XDR-4821	Info	—	—
Oct 8, 07:24:00 PT	AUD-51202	AI SOC	Vault SOC	Requested approval	ACT-9012, ACT-9014	Info	CP-03, CP-08	—
Oct 8, 07:23:00 PT	AUD-51203	AI SOC	Graph (GCC High)	Read sign-ins	j.reyes	Success	—	—
Oct 8, 07:22:00 PT	AUD-51204	AI SOC	Strata Cloud Manager	Query traffic/threat logs	185.220.101.47	Success	—	—
Oct 8, 07:21:00 PT	AUD-51205	AI SOC	Cortex XDR	Run XQL query	ENG-WS-114	Success	—	—
Oct 8, 07:08:00 PT	AUD-51206	AI SOC	Graph (GCC High)	Requested approval	ACT-9017 · m.alvarez	Info	CP-12	—
Oct 8, 06:49:00 PT	AUD-51207	AI SOC	Strata Cloud Manager	Correlated ATP block	SCM-TP-2290	Info	—	—
Oct 8, 05:55:00 PT	AUD-51208	AI SOC	Cortex XDR	Closed as benign with evidence	XDR-4820	Success	—	—
Oct 8, 05:20:00 PT	AUD-51209	AI SOC	Prisma Access	Closed as benign with evidence	PA-BF-1440	Success	—	—
Oct 8, 04:27:00 PT	AUD-51210	AI SOC	Cortex XDR	Kill process + quarantine	HP-FS-01	Success	CP-07 · Auto	POL-v1.3
Oct 8, 02:19:00 PT	AUD-51211	AI SOC	Graph (GCC High)	Soft-delete 3 messages	Invoice_0921.iso	Success	CP-11 · Auto	POL-v1.3
Oct 7, 19:30:00 PT	AUD-51212	D. Mercer (Vault)	Vault SOC	Engaged Unit 42 (6 hrs)	XDR-4799	Success	—	ESC-0192
Oct 7, 10:00:00 PT	AUD-51213	D. Mercer (Vault)	Cortex XDR	Isolate endpoint	ENG-WS-066	Success	CP-01 · Approve	APR-3301
Oct 7, 09:50:00 PT	AUD-51214	AI SOC	Strata Cloud Manager	WildFire verdict lookup	SCM-WF-772	Success	—	—