Observability
Every access.
One audit trail.
Auth events, service access, cloud credentials, infrastructure findings -- all in one searchable, immutable timeline. Export to any SIEM.
Available on Free and above. See pricing
Unified access timeline
Every layer, every decision, every user — one timeline.
Most stacks scatter the evidence: the IdP knows who logged in, the API gateway knows which request it served, the cloud provider knows which token it minted, and nothing knows the causal chain between them. AuthFI sits on the path of every access decision and writes them to one wire-ordered log. A login, an app authorization, an in-kernel allow/deny, and a cloud credential land as adjacent rows on the same timeline — keyed by the same subject, so a session reads as one story instead of four disconnected searches.
{
"seq": 10412,
"ts": "2026-06-21T10:31:00Z",
"event": "POST /api/invoices DENIED",
"subject": "alice@acme.com",
"prev_hash": "3f9c…a17e",
"hash": "b2d4…90f1" // SHA-256(prev_hash ‖ record)
}Tamper-evident
Immutable isn't a setting. It's a hash chain.
"Immutable audit" only means something if you can prove a row wasn't edited or deleted after
the fact. AuthFI writes the trail append-only and hash-chains it: each record carries a SHA-256 digest of the record before it, so the log links into a tamper-evident
chain. Periodically the chain is anchored by publishing a Merkle root over the
epoch — the same construction Certificate Transparency uses. Change one byte of one historical
row and every downstream hash, and the root, stops matching.
- The problem it removes: the "trust me, the logs are clean" gap — an attacker or insider with write access can no longer quietly rewrite history.
- Verifiable, not just stored: a reviewer re-hashes the chain and compares one Merkle root instead of diffing millions of rows by hand.
- The payoff: the trail stands up as evidence — what SOC 2, ISO 27001 and breach forensics actually demand of an audit log.
The streams
Five log streams, one platform.
Coverage is the hard part of audit: a trail with a blind spot is a trail an attacker walks through. Because AuthFI is in the path from the browser to the kernel to the cloud, it captures the decision at each layer at the point it's made — not reconstructed later from sampled traffic. One schema, one subject key, five sources of truth.
Auth logs
Logins, logouts, MFA challenges, password resets, SSO events, brute force detection.
Service logs (eBPF)
Every HTTP request decision at the kernel -- allow/deny, user, method, path, latency.
Cloud access logs
Cloud credential issuance -- console signin, API credentials, role, MFA status.
App access logs
OAuth2 authorization -- token issuance, consent grants, scope validation.
Agent audit logs
Infrastructure findings -- privileged containers, open ports, security posture scores.
Detection & response
An audit log you only read after a breach is a postmortem.
Identity Threat Detection & Response (ITDR) turns the same streams into a control. Because login, authorization, in-kernel request decisions and cloud-credential issuance share one subject key, AuthFI correlates them in real time and scores behavior against the account's baseline. Impossible travel, MFA-fatigue bursts, a sudden privilege jump, lateral motion a service has never made before — these are cross-stream patterns no single log can see. When the score crosses the line, the response runs where the access lives: step up MFA, revoke a cloud token, or kill the session at the kernel.
- Mechanism: correlation on a shared identity, not pattern-matching one log in isolation — the signal is the relationship between streams.
- Closed loop: detection and enforcement are the same plane, so response is an action, not a ticket filed to another team.
- The payoff: the gap between compromise and containment shrinks from the forensic timescale to the request timescale.
Export & search
Export to any SIEM. Search before you do.
The audit trail is yours, not a walled garden. AuthFI forwards events to the SIEM your SOC already runs on — over the destination's own ingestion contract, so the data lands as native, queryable events rather than opaque blobs. And because the trail is indexed in place, you can answer "show me every denied request for this user across every layer last Tuesday" without waiting on a downstream pipeline.
Splunk
HEC (HTTP Event Collector). Real-time log forwarding.
Datadog
Log pipeline integration. Tags and facets auto-mapped.
Grafana / Loki
LogQL-compatible export. Labels from AuthFI metadata.
One trail, end to end
Stop stitching logs. Read one story.
The alternative is glue: ship five log formats to a SIEM, write the join keys yourself, and hope the clocks agree well enough to reconstruct what happened. AuthFI does the correlation at the source because it's already on the access path — the join is the product, not your homework.
Captured at the source
Decisions are logged where they're made — IdP, app authorization, in-kernel via eBPF, cloud credential issuance — not inferred later from sampled traffic that may have dropped the row you need.
Tamper-evident by default
Append-only, SHA-256 hash-chained, Merkle-anchored per epoch. The trail you hand an auditor is one they can independently verify — immutability you can prove, not promise.
Yours to take anywhere
Searchable in place and exported to Splunk, Datadog and Grafana/Loki on their native contracts. No lock-in, no parser to maintain, no per-layer integration to build.
Get started
Ready to get started?
Free for 5,000 monthly active users. No credit card required.