PolicyCortex Audit Logging for Complete Visibility & Compliance

# Search audit logs via API
curl -X GET "https://api.policycortex.com/v1/audit/search" \
  -H "Authorization: Bearer sk_live_1234567890abcdef" \
  -H "Content-Type: application/json" \
  -d '{
    "query": {
      "time_range": {
        "start": "2024-01-01T00:00:00Z",
        "end": "2024-01-31T23:59:59Z"
      },
      "filters": {
        "event_type": ["user_action", "system_change"],
        "user_email": "admin@company.com",
        "action": ["policy_deployed", "user_created"],
        "severity": ["high", "critical"],
        "resource_type": "policy"
      },
      "search_text": "encryption policy",
      "sort": {
        "field": "timestamp",
        "order": "desc"
      },
      "limit": 100
    }
  }'

# Complex search with aggregations
curl -X POST "https://api.policycortex.com/v1/audit/analytics" \
  -H "Authorization: Bearer sk_live_1234567890abcdef" \
  -H "Content-Type: application/json" \
  -d '{
    "analysis_type": "user_activity_summary",
    "time_range": {
      "start": "2024-01-01T00:00:00Z",
      "end": "2024-01-31T23:59:59Z"
    },
    "group_by": ["user_id", "action"],
    "metrics": ["count", "unique_resources", "risk_score_avg"],
    "filters": {
      "role": ["system_administrator", "compliance_manager"]
    }
  }'

# Export audit logs for external analysis
curl -X POST "https://api.policycortex.com/v1/audit/export" \
  -H "Authorization: Bearer sk_live_1234567890abcdef" \
  -H "Content-Type: application/json" \
  -d '{
    "format": "json",
    "compression": "gzip",
    "filters": {
      "time_range": {
        "start": "2024-01-01T00:00:00Z",
        "end": "2024-01-31T23:59:59Z"
      },
      "compliance_tags": ["sox", "soc2"]
    },
    "delivery": {
      "method": "download_link",
      "encryption": {
        "enabled": true,
        "algorithm": "AES-256-GCM"
      },
      "expires_in": "24h"
    }
  }'

{
  "retention_policies": [
    {
      "name": "Financial Data Retention",
      "description": "SOX compliance requires 7-year retention",
      "applies_to": {
        "event_types": ["user_action", "system_change", "data_access"],
        "compliance_tags": ["sox", "financial"],
        "data_classifications": ["financial", "audit"]
      },
      "retention_period": "7_years",
      "storage_tiers": [
        {
          "tier": "hot",
          "duration": "90_days",
          "storage_class": "standard",
          "search_enabled": true,
          "real_time_alerts": true
        },
        {
          "tier": "warm",
          "duration": "1_year",
          "storage_class": "infrequent_access",
          "search_enabled": true,
          "search_latency": "minutes"
        },
        {
          "tier": "cold",
          "duration": "6_years",
          "storage_class": "glacier",
          "search_enabled": false,
          "retrieval_time": "hours"
        }
      ]
    },
    {
      "name": "GDPR Personal Data",
      "description": "EU personal data processing logs",
      "applies_to": {
        "data_classifications": ["pii", "personal"],
        "geographic_scope": ["eu"],
        "compliance_tags": ["gdpr"]
      },
      "retention_period": "3_years",
      "deletion_triggers": [
        "data_subject_erasure_request",
        "consent_withdrawal",
        "processing_purpose_fulfilled"
      ],
      "encryption": {
        "at_rest": true,
        "in_transit": true,
        "key_rotation": "quarterly"
      }
    },
    {
      "name": "Security Incident Logs",
      "description": "Extended retention for security investigations",
      "applies_to": {
        "severity": ["high", "critical"],
        "categories": ["security", "breach"],
        "event_types": ["failed_authentication", "privilege_escalation"]
      },
      "retention_period": "10_years",
      "immutable_storage": true,
      "legal_hold_capable": true
    }
  ],
  "global_settings": {
    "minimum_retention": "1_year",
    "deletion_verification": "required",
    "backup_frequency": "daily",
    "geographic_replication": true,
    "disaster_recovery": {
      "enabled": true,
      "rpo": "1_hour",
      "rto": "4_hours"
    }
  }
}