Security, DevOps and compliance teams can now answer "who did what, and when" from one place. Atatus Security Audit Logs collects audit logs from your hosts, Kubernetes clusters, cloud accounts, identity providers and DevOps tools into a single searchable audit trail.
Every source is mapped to the same fields, so an Okta login, a CloudTrail API call and a Linux sudo command line up in one timeline. Detection rules mapped to MITRE ATT&CK watch the trail, each integration's health shows when a feed stops, and the Compliance tab tracks control status to help you prepare for audits.
What Security Audit Logs gives you
- One audit trail: Collect audit logs from Linux hosts and self-hosted Kubernetes clusters with Atatus agent 4.2.0 or later, and from AWS, Azure, Google Cloud, Okta, GitHub, CrowdStrike, PagerDuty and other integrations. Search them together on the Events tab of Cloud SIEM.
- Same fields for every source: Events are normalized to common fields such as user, source IP and outcome, so one filter searches all of them without custom parsing pipelines.
- Source health: Each integration shows its last poll, last event, error count and hourly event volume for the past 24 hours, with a Healthy or Error status, so you catch a broken feed before it leaves a gap in your audit trail.
- Follow one actor: Filter by a user, IP address or host and see what it did across every connected tool, in time order.
- Built-in detection rules: Rules mapped to MITRE ATT&CK flag brute force attempts, MFA fatigue, credential stuffing, impossible travel, privilege escalation and data exfiltration, each with a severity.
- Compliance tracking: Track pass rates and control status over time for SOC 2, PCI DSS, HIPAA, ISO 27001, NIST 800-53, CIS Controls and GDPR.