Audit Logs Overview

Audit Logs help you record a durable, structured history of the actions that happen across your application and within Edlink. The core goals of audit logs are to answer the questions:

• What happened?
• Who did it?
• When did it happen?

Audit logs are critical for security and compliance. Not only can they help understand the fallout from a security incident, but they can help detect incidents in real-time so you can respond quickly and contain the damage.

This type of logging is already something that most companies agree to do in Data Processing Agreements (DPA) and other contracts, but the reality is that it's often not implemented in a way that is visible or useful for IT administrators. After putting in a request for audit logs, the vendor often doesn't have a good way to find logs that belong to your institution or help you parse them for answers. As a result, it can take weeks or months to get a handle on what happened and who was involved.

Companies are also leaving valuable cybersecurity data on the table, missing out on opportunities to improve their security posture and reduce risk.

Edlink Audit Logs are designed to solve these problems. Our Audit Log API is a comprehensive solution for capturing, storing, and analyzing, and displaying security events across your application. This capability saves time and reduces risk across both companies and institutions.

It's free to use the Audit Log API (you do not need to work with Edlink for LMS or SIS integrations to use it). This means that you can define & capture events in your application, send them to Edlink for analysis and storage, and then query them as needed - either directly, or via our pre-built UI widgets.

Audit Logging for Companies

You can use the Audit Log API to capture events for institutions integrated via Edlink and ones that are not integrated via Edlink. Here's how to get started.

1. Sign up and create a new application
2. Tell Edlink what types of events you plan to capture using Event Schemas
3. Optionally, use our SDK (and AI skills) to capture events in your application
4. Emit events to Edlink for analysis and storage
5. Query audit logs as needed (either directly, or via our pre-built UI widgets)

Some notes about Audit Logs:

• Audit Logs are currently stored in the US region only. We may support other regions in the future.
• Audit Logs are stored for 30 days, after which they are permanently deleted.
• Edlink will validate events and automatically enrich them with additional context (e.g. IP address, etc.).

Audit Logging for Institutions

At the moment, institutions can only interact with the Audit Log API via a company's product. You may see the results of these logs in a company's dashboard, but you cannot access them directly via Edlink at the present time.

In the future, we are planning the following updates to Audit Logging for institutions:

1. A new "Audit Logs" section available in the Edlink dashboard for institutions to view and search their logs across any connected vendors.
2. The ability to pipe audit logs directly into a third-party log management system like Datadog or Splunk.
3. The ability to export audit logs to a CSV file for offline analysis.