Every decision logged and exportable
Accept, block, threat and greywall, with reason, client and rank.
Traffic Logs record every lookup. The change log records every configuration change. Publish history records what was in force and lets you roll back.
| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 14:02:11 | accept | research-agent | api.openai.com | 10.40.2.17 | allow list |
| 2026-09-15 14:02:11 | accept | research-agent | api.tavily.com | 10.40.2.17 | allow list |
| 2026-09-15 14:02:14 | greywall | research-agent | cdn-assets-sync.top | 10.40.2.17 | first seen, held 24h |
| 2026-09-15 14:02:14 | block | research-agent | dns.google | 10.40.2.17 | category: DoH provider |
| 2026-09-15 14:02:19 | threat | research-agent | update-check.pw | 10.40.2.17 | feed: c2-indicators |
| 2026-09-15 14:02:31 | accept | finance-agent | api.stripe.com | 10.40.3.8 | allow list |
A control without a record is a promise
Security and compliance both ask the same two questions after the fact: what did the control decide, and who set it up that way. Both answers have to exist without anyone remembering to write them down.
Decisions
Every lookup, with the action and the reason, retained and forwardable.
Changes
Every policy, list, feed and site change with the user, the timestamp and the content.
State
Every publish as a snapshot, so the configuration in force on a given day is known and restorable.
Three records, kept by default
Traffic Logs
Seventeen filters, CSV, JSON and CEF export, scheduled exports, API retrieval.
Change log
Filter by object, user or date. Export. Every API change carries the key that made it.
Publishes
History of every publish with status. Roll back to any prior snapshot in one action.
Event and audit capabilities
Every field
Timestamp, action, reason, site, client, name, type, protocol, categories, rank, answer, ASN, country.
Forwarding
Syslog to your collector, CEF for ArcSight and Sentinel, JSON for the data lake.
API retrieval
Scheduled ingestion with a dashboard:read key and the same filters as the console.
Webhooks
Six signed events: threat.detected, config.published, config.failed, list.updated, feed.polled, device.registered.
Change log
User, timestamp, object and content for every change, including rollbacks.
Rollback
Restore any prior publish. The restore is itself a logged change.
A publish, signed
Every publish and every failure is a signed event. Page on config.failed; audit on config.published.
{
"event": "config.published",
"timestamp": "2026-09-15T10:04:11Z",
"data": { "publish_id": 4412, "triggered_by": "j.rivera", "keys_written": 2, "status": "succeeded" }
}Questions teams ask
How long are events retained?
Per plan. Forward to your SIEM for longer retention.
Is the record immutable?
Events are written once and forwarded; the change log records every change. Retain both in your system of record for immutability.
Can I export everything?
Yes. Traffic Logs as CSV, JSON or CEF; configuration and the change log through the API.
See agent events in your SIEM this week
One syslog destination, one verification query.