Features · Log review
Log review
Evidence that someone reads the security logs
ISO 27001 asks for more than logging: A.8.15 and A.8.16 expect the logs to be monitored and reviewed, and the auditor will ask to see that it happened. Astrari turns what the agent already observes into a review queue, records who decided what and when, asks for a weekly sign-off, and produces the evidence pack.
What it does
A short queue, not a log viewer
Only events a person should look at land in the queue: new SSH logins, root and shared-account logins, first-time sudo, account and group changes, failed-login bursts, security controls that went quiet, malware and system-path integrity changes, and gaps in what was read. Repeats collapse into one event with a count.
Decisions that stay on the record
Each event is marked Expected, Investigating or Escalated, with an optional note; Escalated can open or link a finding. Decisions are append-only: a later decision supersedes an earlier one and both remain, with the reviewer and the time.
A weekly sign-off
Each Monday-to-Sunday week is signed off by a reviewer, with the week's counts and coverage stored alongside. A week cannot be signed while a HIGH event in it is unreviewed. A week left unsigned seven days after it ended is recorded as missed, and a late sign-off is marked late.
An evidence pack for the auditor
For any period — and automatically each month — a PDF and CSV listing the servers in scope, the log sources read, coverage and every gap with its dates, each event with its decision, the sign-off log and a method statement.
In the dashboard
What lands in the queue
- ▸ A successful SSH login for a user from an address not seen for them in 90 days
- ▸ Root logins, and logins to accounts you mark as shared
- ▸ sudo by a user not seen using sudo before; sudo and su failures
- ▸ Account and group changes — useradd, userdel, usermod, groupadd, passwd and chage for another user
- ▸ Failed-login bursts per address or user, one event per burst rather than one per attempt
- ▸ A security control that went quiet or failed, malware hits and file-integrity changes on system paths
- ▸ Intrusion detection ban spikes and attacks from a new country or network
- ▸ Gaps in coverage: hours with no agent data, rotated or truncated logs, sources read only in part
Example event
Account change: user-add jsmith on staging-01
Decision: Expected — "jsmith onboarding, ticket OPS-142", by the reviewer on Monday at 10:50. The masked log line and the decision history stay with the event.
How it works
- 1
Opt servers in
Log review is off by default. Turn it on per server from its Signals tab, or in bulk from Settings → Log review. Every change is recorded in the audit log, and the evidence pack shows each server's enabled period.
- 2
Review as events arrive
Events are derived every 15 minutes from data the agent already sends. Mark routine items Expected in bulk, investigate the rest, and add rules that mark known activity — your deploy user from your office range, say — Expected automatically, recorded as a decision by that rule.
- 3
Sign off the week
On Monday, designated reviewers get a reminder for last week. Signing records the counts and coverage; any remaining MEDIUM or LOW events can be acknowledged in the same step.
- 4
Hand over the evidence
Download the monthly evidence pack, or generate one for the auditor's exact period. Agencies can give clients their own login to review, sign off and download for their servers.
Plans
Included on every plan, Starter included. Client portal access — clients reviewing and signing off their own servers — uses client sub-accounts on the Agency plan. Compare plans.
Good to know
- ▸ Review events start from the moment a server is enabled; earlier activity is not backfilled.
- ▸ Account and group changes (useradd, usermod, groupadd, passwd and similar) need agent 0.2.116 or later, which is shipping next. The other event types work with the agent you have.
- ▸ Decisions and sign-offs are append-only. A mistaken decision is corrected by a later one, never edited or deleted.
- ▸ Raw log lines never leave the server. Events carry counts, the user, address or path concerned and, for account changes, one masked sample line. Everything is kept for 13 months by default (12 to 36, set by the organisation owner).
See it on your own servers
The free Starter plan covers one website and one Linux server. The agent installs with one command and reports its first scan within a minute.