Every recommendation viewed, accepted, dismissed or applied is recorded with actor, timestamp and tenant context — chained, immutable and exportable to Splunk, Sentinel, Datadog or any SIEM.
By the numbers
login · apply · ticket · SCIM · commitment · …
0+
action types tracked
each event hashes the previous
0
SHA-256 hash chain
Splunk HEC · Datadog Logs · Sumo · HTTP
0
SIEM destinations
append-only by design
0
ways to mutate a past event
How it works
AuditService.record() runs after every state-changing call: LOGIN, RECOMMENDATION_APPLIED, TICKET_CREATED, COMMITMENT_*, SCIM_USER_*, CUSTOM_ROLE_*, COMPLIANCE_REPORT_GENERATED — 50+ action types in total — with actor, entity and JSON before/after.
50+ actions · 20+ entities
Each event stores a SHA-256 integrityHash of (userId + action + entityId + beforeState + timestamp), referencing the previous event so any mutation breaks the chain.
SHA-256 · append-only
On each save, SiemDispatcher pushes the event to your configured SIEM — Splunk HEC, Datadog Logs, Sumo Logic or any Generic HTTP endpoint with bearer / header / basic auth.
Enterprise plan · async
What's inside
Who, what, when, on which tenant, with which authentication method and from which IP — every event is captured in the canonical schema auditors expect for SOC 2 CC7.2 and ISO 27001 A.12.4.1.
Each event is hashed and chained to its predecessor. A daily Merkle root is published, so any silent rewrite of history becomes mathematically detectable.
Push events in near-real-time to Splunk HEC, Microsoft Sentinel, Datadog, S3-CMK or any HTTPS / Kafka endpoint that speaks JSON.
Capabilities
Before vs after Lumicost
Without Lumicost
With Lumicost
Where teams use it
Hand the auditor a single CSV per period, signed and hash-verifiable, instead of three weeks of screenshots.
Trace exactly who saw and dismissed a high-impact recommendation — and when — across all tenants.
Give your customer a per-tenant audit feed they can ingest into their own SIEM.
From the field
“If we control the audit trail and you don't, you don't really have an audit trail. SIEM export is how you keep the receipts.”
Plays nice with your stack
FAQ
7 years by default; configurable to your data-residency policy. Hot for 90 days, cold thereafter.
Yes. We publish a daily Merkle root and each event ships with the path needed to verify it independently.
Keep exploring
Connect read-only credentials. First insights in 24 hours. No credit card.
90 seconds · read-only credentials · no credit card