Auditing and Logging

Copy

• Copy for LLM

  Copy page as Markdown for LLMs
• View as Markdown

  Open this page as Markdown
• Open in ChatGPT

  Get insights from ChatGPT
• Open in Claude

  Get insights from Claude
• Connect to Cursor

  Install MCP server on Cursor
• Connect to VS Code

  Install MCP server on VS Code

Capsule Security provides comprehensive auditing and logging capabilities for AI agent activity across your organization. This guide covers the platform's native observability features and how to forward audit data to your centralized SIEM — including Splunk and Microsoft Sentinel.

Platform Auditing and Logging

Audit Event Types

Every AI agent interaction monitored by Capsule generates structured audit events. These events are persisted in the platform database and are immediately available for search, filtering, and investigation.

Audit Data Structure

Each audit event includes:

• Timestamp — when the event occurred
• Session ID — groups events into conversation sessions
• Agent — the AI agent that generated the event, including platform and environment
• User — the identity of the user interacting with the agent
• Entity — the tool, data source, skill, or access channel involved
• Message — human-readable event content (full-text searchable)
• Detections — any security detections triggered by this event
• Findings — security findings linked to this event
• Policies — policies evaluated during this event
• Metadata — raw JSON payload from the source platform for forensic analysis

Searching and Filtering Audit Logs

Navigate to Observability in the Capsule portal to access the full audit log. The interface supports:

• Full-text search across event messages and agent names
• Date range filtering with custom time windows
• Agent filtering by specific agent or platform type (e.g., all Azure AI Foundry agents)
• Activity type filtering — narrow to specific event types (sessions, tool calls, detections, etc.)
• Detection type filtering — view only events that triggered specific detection categories
• Finding type filtering — filter by finding classification
• Issue filtering — find all sessions linked to a specific issue
• Tool / Data Source / Channel / Skill filtering — drill into events involving a specific entity

Results are sortable by timestamp, agent name, or event type. The timeline chart provides a visual overview of activity density and security indicators across your chosen time window.

Session-Based Investigation

Audit events are grouped into sessions — the complete lifecycle of an agent conversation. Selecting a session in the Observability view shows:

• The full ordered sequence of events (user messages, agent responses, tool calls, etc.)
• Security detections triggered during the session
• Issues created from the session
• Policy evaluation results

This session-level view is the primary interface for incident investigation and forensic review.

CSV Export

All audit data visible in the portal can be exported to CSV for offline analysis, compliance reporting, or ingestion into external systems. Use the Export action in the toolbar of any inventory or observability page. The export runs in batches with progress tracking and supports cancellation.

Data Retention

Capsule retains all audit data in the platform database for the lifetime of your tenant. Data is soft-deleted (never physically removed during normal operation), ensuring a complete audit trail is available for investigation.

90-day searchable / 1-year archive requirement: All deployment models meet this requirement by default. Audit data is stored in PostgreSQL and remains fully searchable (with full-text search indexes) for the entire retention period — there is no degradation from "searchable" to "archived" state. For Customer Hosted VPC deployments, customers can additionally configure RDS automated snapshot retention to satisfy specific compliance windows.

SIEM Integration

Capsule supports forwarding audit data to your organization's centralized SIEM for correlation with other security telemetry, long-term archival, and SOC workflows.

Architecture Overview

┌──────────────────────────────────────────────────────────┐
│                    Capsule Security                       │
│                                                          │
│  ┌──────────────┐    ┌──────────────┐    ┌────────────┐  │
│  │  Audit Event  │───▶│   Webhook    │───▶│  SIEM      │  │
│  │  Pipeline     │    │   Events API │    │  Connector │  │
│  └──────────────┘    └──────────────┘    └─────┬──────┘  │
│                                                │         │
└────────────────────────────────────────────────┼─────────┘
                                                 │
                      ┌──────────────────────────┼─────────┐
                      │         Customer SIEM               │
                      │                                     │
                      │    ┌────────────┐  ┌────────────┐   │
                      │    │   Splunk   │  │  Microsoft │   │
                      │    │            │  │  Sentinel  │   │
                      │    └────────────┘  └────────────┘   │
                      │                                     │
                      └─────────────────────────────────────┘

Capsule provides two mechanisms for SIEM integration:

1. Webhook Events API — Capsule's REST API emits structured JSON events that SIEM platforms can consume directly via HTTP Event Collector (Splunk) or Data Collector API (Sentinel)
2. CSV Export — bulk export for historical data backfill or periodic batch ingestion

Splunk Integration

Splunk HTTP Event Collector (HEC)

Use Splunk's built-in HTTP Event Collector to receive Capsule audit events in real time.

Prerequisites:

• Splunk Enterprise or Splunk Cloud with HEC enabled
• A Capsule Security account with admin access

Step 1 — Configure Splunk HEC

1. In Splunk, navigate to Settings > Data Inputs > HTTP Event Collector
2. Click New Token
3. Set the source type to _json and choose your target index
4. Copy the generated HEC token and note the HEC endpoint URL

https://<splunk-host>:8088/services/collector/event

Step 2 — Configure the Capsule-to-Splunk Connector

Forward Capsule audit events to your Splunk HEC endpoint. Events are delivered as structured JSON with the following schema:

{
  "event": {
    "timestamp": "2026-03-19T10:30:00Z",
    "sessionId": "sess-abc123",
    "auditType": "ToolInvocation",
    "auditSource": "Platform",
    "agent": {
      "id": "agent-uuid",
      "name": "Customer Support Agent",
      "platform": "azure-ai-foundry"
    },
    "user": {
      "email": "user@example.com"
    },
    "message": "database_query: SELECT * FROM orders WHERE status = 'pending'",
    "detections": ["sensitive-data-access"],
    "metadata": {}
  },
  "sourcetype": "capsule:audit",
  "source": "capsule-security",
  "index": "capsule_audit"
}

Step 3 — Create Splunk Dashboards and Alerts

Use the capsule:audit sourcetype to build Splunk dashboards:

index=capsule_audit sourcetype="capsule:audit"
| spath output=audit_type path=event.auditType
| spath output=agent_name path=event.agent.name
| spath output=user_email path=event.user.email
| timechart count by audit_type

Example alert for policy violations:

index=capsule_audit sourcetype="capsule:audit" event.auditType="PolicyEvaluated"
| spath output=agent_name path=event.agent.name
| spath output=message path=event.message
| where isnotnull(message)
| table _time agent_name message

Microsoft Sentinel Integration

Azure Monitor Data Collector API

Send Capsule audit events to a Microsoft Sentinel Log Analytics workspace using the HTTP Data Collector API.

Prerequisites:

• Microsoft Sentinel workspace in Azure
• Log Analytics Workspace ID and Primary Key

Step 1 — Create a Custom Log Table

Events are ingested into a custom log table named CapsuleAudit_CL. Sentinel automatically creates the table schema on first ingestion.

Step 2 — Forward Events via Data Collector API

Capsule audit events are posted to the Log Analytics Data Collector API:

POST https://<workspace-id>.ods.opinsights.azure.com/api/logs?api-version=2016-04-01
Content-Type: application/json
Log-Type: CapsuleAudit

[
  {
    "TimeGenerated": "2026-03-19T10:30:00Z",
    "SessionId": "sess-abc123",
    "AuditType": "ToolInvocation",
    "AuditSource": "Platform",
    "AgentId": "agent-uuid",
    "AgentName": "Customer Support Agent",
    "Platform": "azure-ai-foundry",
    "UserEmail": "user@example.com",
    "Message": "database_query: SELECT * FROM orders WHERE status = 'pending'",
    "Detections": "sensitive-data-access"
  }
]

Step 3 — Query in Sentinel

Use KQL to query Capsule audit data:

CapsuleAudit_CL
| where AuditType_s == "ToolInvocation"
| summarize count() by AgentName_s, bin(TimeGenerated, 1h)
| render timechart

Example detection rule for high-risk agent activity:

CapsuleAudit_CL
| where AuditType_s in ("PolicyEvaluated", "DetectionCreated")
| summarize DetectionCount = count() by AgentName_s, UserEmail_s, bin(TimeGenerated, 15m)
| where DetectionCount > 10

Centralized Log Offloading

Can Capsule offload logs to a centralized SIEM? Yes.

Capsule supports offloading all audit and security event data to customer-managed SIEM platforms. The integration methods described above (Splunk HEC and Sentinel Data Collector API) enable real-time or near-real-time forwarding of structured audit data to your organization's centralized logging infrastructure.

Retention and Archival Compliance

Does Capsule support 90-day searchable logs and 1-year archived data?

Yes. The following table summarizes how each deployment model meets this requirement:

For organizations requiring strict compliance with 90-day/1-year retention policies, the recommended approach is:

1. Primary retention — Capsule platform retains all audit data with full search capability for the tenant lifetime (exceeds 90-day requirement)
2. SIEM forwarding — Forward events to Splunk or Sentinel for correlation, alerting, and SOC workflows
3. Long-term archival — Configure your SIEM's archival tier (Splunk SmartStore, Sentinel Archive Logs) to retain data for 1+ year at reduced storage cost

Security and Compliance

Support

For help configuring SIEM integrations or meeting specific compliance requirements, contact support@capsule.security.