One audit trail.
Everything. Everywhere.
Login events, app access, service access (eBPF), AuthFI Connect, network activity — all in one timeline. One dashboard for security. One export for auditors. No log aggregation required.
Unified timeline — every layer, one view
Follow a user across every layer of your stack. Login to app to service to cloud to network — all in one chronological feed. Color-coded by layer. Every decision logged.
What gets logged
Five log categories, each with structured fields. Every event is queryable by any field. Retention configurable per plan.
Auth logs
Every authentication event — logins, logouts, MFA challenges, password resets, SSO, magic links, brute force detection.
App access logs
Every OAuth2 authorization — token issuance, consent grants, scope validation, app access decisions.
Service logs (eBPF)
Every HTTP request decision at the kernel level — allow/deny, user, method, path, latency, policy match.
AuthFI Connect logs
Every cloud credential issuance — console signin, API credentials, which role, which account, MFA status.
Agent audit logs
Infrastructure findings — privileged containers, open ports, root processes, security posture scores per host.
Real-time streaming
Events stream to the console dashboard in real time via Server-Sent Events (SSE). Watch logins, access decisions, and security events as they happen. No polling. No delay.
GET /v1/acme/events/stream
Authorization: Bearer <admin-jwt>
Accept: text/event-stream
// Optional filters:
?layer=SERVICE,CLOUD
?user=alice@acme.com
?status=deny
// Events arrive as SSE:
data: {"layer":"SERVICE","user":"alice@acme.com",...}
data: {"layer":"CLOUD","user":"bob@acme.com",...}
SIEM export
Export logs to your existing security tools. CSV for spreadsheets and auditors. JSON for programmatic ingestion. Webhook for real-time forwarding to Splunk, Elastic, Datadog.
CSV export
Download filtered logs as CSV. Perfect for auditors, compliance reviews, and spreadsheet analysis.
?format=csv
&from=2026-03-01
&to=2026-03-26
&layer=CLOUD
✓ 2,847 events exported
JSON export
Structured JSON with full event details. Pipe into your data warehouse, SIEM, or custom dashboards.
?format=json
&user=alice@acme.com
&layer=SERVICE
✓ NDJSON stream
Webhook forwarding
Forward events in real time to Splunk HEC, Elastic, Datadog, or any HTTP endpoint.
url: https://splunk.acme.com/hec
events: [LOGIN, SERVICE, CLOUD]
format: json
✓ Real-time delivery
Supported destinations
Splunk Elasticsearch Datadog Sumo Logic AWS CloudWatch 
GCP Cloud Logging Azure Monitor 
Grafana 
Prometheus Any HTTP endpoint
OpenTelemetry export
Export authentication and access events as OpenTelemetry spans. Distributed tracing across your entire stack — from login to service to cloud. Enterprise feature.
What gets traced
- ✓ Authentication flow (login → MFA → token issued)
- ✓ OAuth2 authorization (consent → token exchange)
- ✓ eBPF access decisions (request → policy eval → allow/deny)
- ✓ Cloud credential issuance (token exchange → STS call)
- ✓ SCIM provisioning (create/update/delete at target)
Configuration
endpoint: https://otel.acme.com:4317
protocol: grpc
headers:
Authorization: Bearer <token>
resource:
service.name: authfi
service.version: 1.0
✓ Spans include trace_id, span_id, parent
✓ Correlate with your app's traces
trace_id: abc123
| authfi.login 120ms (email + TOTP MFA)
| | authfi.authorize 8ms (scope: read:patients)
| | | your-app.handler 45ms (GET /patients/123)
| | | | authfi.ebpf 0.045ms (policy check)
| | | | authfi.cloud 85ms (GCP token exchange)
| | | | | gcs.getObject 120ms (patient image)
// One trace_id across AuthFI + your app + cloud
Built-in analytics dashboards
Pre-built dashboards for security, operations, and compliance. No external tools needed. Real-time data from all layers.
Logins over time
Success vs failure. Hourly, daily, weekly. Spike detection for brute force attacks.
Top applications
Most accessed apps by user count and token issuance. Identify unused apps.
Auth methods
Password vs SSO vs magic link vs passkey. Track MFA adoption rate over time.
Denied requests
eBPF denials by service, user, and reason. Identify misconfigured policies.
AuthFI Connect frequency
Which clouds, which roles, how often. Track credential issuance patterns.
Active sessions
Concurrent sessions over time. Per-user session count. Anomaly detection.
Compliance — audit-ready from day one
AuthFI's unified audit trail makes compliance evidence easy. Access reviews, login reports, change management audit — all exportable in the format auditors expect.
SOC 2 Type II
Supported- ✓ Access control logs
- ✓ Change management audit
- ✓ MFA enforcement evidence
- ✓ User lifecycle events
HIPAA
Supported- ✓ PHI access logging
- ✓ User authentication audit
- ✓ Access review reports
- ✓ Minimum necessary access
GDPR
Supported- ✓ Consent tracking
- ✓ Data access logs
- ✓ Right to erasure evidence
- ✓ Data processing records
ISO 27001
Supported- ✓ Information security events
- ✓ Access control records
- ✓ Incident response logs
- ✓ Risk assessment data
Access review workflow
Related features
Available on Free and above. See pricing →
One platform. Every identity layer.
Free to start.
Free for 5,000 users. Upgrade when you're ready.
Start building free →