Bulwark|Docs

Audit Trail

The audit trail provides a complete record of every tool call made by your agents, including policy decisions and approval outcomes. Use it for compliance reviews, debugging policy behavior, and understanding agent activity across devices.

What Gets Logged

Every agent hook event is recorded with the following information:

FieldDescription
Tool NameThe tool that was invoked (e.g., Bash, Edit, Write)
Event TypeThe hook event name (e.g., PermissionRequest, SessionEnd)
Tool InputFirst 120 characters of the tool's input parameters
DeviceThe hostname of the device running the agent
TimestampExact time of the event
Permission StatusWhether the call was allowed, denied, pending, or expired
Policy InfoWhich policy matched and what action it specified
Decision SourceWhether the decision came from a policy or manual approval

Filtering Events

The audit trail includes four filters to narrow down results:

FilterDescription
DeviceFilter by device hostname (default: All devices)
Tool NameFilter by specific tool (default: All tools)
Date FromShow events after this date
Date ToShow events before this date

By default, the audit trail shows the last 7 days of events. Use the Clear filters button to reset all filters.

Browsing Results

Events are displayed in reverse chronological order (newest first), 25 per page. Click Load More at the bottom to fetch the next page of results.

Status Badges

Each event displays colored badges indicating what happened:

Permission status:

BadgeColorMeaning
AllowedGreenThe tool call was permitted
DeniedRedThe tool call was blocked
PendingAmberThe tool call is awaiting approval
ExpiredGrayThe approval request timed out

Decision source:

BadgeColorMeaning
PolicyBlueA policy rule made the decision
ManualPurpleA human approved or denied the request

Exporting Data

Export your filtered audit trail data for external analysis or compliance records. Exports respect your current filters and include up to 10,000 records.

FormatBest For
JSONProgrammatic analysis, preserves full data structure
CSVSpreadsheets, reporting tools, sharing with non-technical stakeholders

The CSV export includes these columns:

ColumnDescription
timestampWhen the event occurred
device_hostnameDevice that generated the event
device_osOperating system of the device
session_idExternal session identifier
tool_nameTool that was called
tool_inputFull tool input parameters
hook_event_nameType of hook event
cwdWorking directory at time of call
permission_statusAllow, deny, pending, or expired
policy_decision_sourcePolicy or manual
policy_nameName of the matched policy
policy_actionAction the policy specified
policy_action_reasonReason for the policy action
sourceSource of the event

Export files are named audit-trail-YYYY-MM-DD.csv or audit-trail-YYYY-MM-DD.json using the date of export.

Next Steps