CEDX Audit · Platform
Three hundred twenty events in the demo stream, and the console's first job is grading its own coverage: 6 of 24 sources passing validation, a digest chain at 72% integrity, and 15 retention gaps — because a trail with holes in it is worse than no trail at all.
The finding that writes the page: the identity production log retains 45 days against a 90-day compliance floor. Nobody tampered with anything — the trail just quietly stopped keeping what it should.
Runs on demo data. Northline Systems in the captures is the software's demo workspace, not a customer.
What it is
The event stream carries time, actor, action, target and result on all 320 rows: role assumes, policy updates, secret creates, lifecycle changes — with Success, Failure and Deny as filter chips. The 25 policy-blocked denies are counted separately, because a deny is the system working, not an error.
The Risk screen splits 72 rows into anomaly trails and retention risk, each with kind, actor, source, severity and score. Under-retained sources top the board at 89; impossible travel and off-hours bursts score in the 60s. The scoring model is a tab, not a secret.
Ninety-six actors — human, service, break-glass, automation — with events, fails, risk and last seen per row. An automation at 8 events and 8 fails scores 93; the break-glass accounts are their own filter chip, because emergency access deserves its own list.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/audit.
01 — Overview
The assurance score is deliberately uncomfortable: integrity at 72%, only 6 of 24 sources healthy, 19 high-risk findings. The alerts are root-caused — an off-hours burst of 9 admin-class events in 74 minutes, a break-glass account assigned without a ticket, a digest window missing for two hours.
02 — Risk
Seventy-two findings where the two failure modes sit side by side: things that happened and should not have, and records that should exist and do not. Filters at 55 and 70 turn the board into a work queue.
03 — Events
Time to the second, actor, action, target, result. A secret create that failed sits two rows from a role assume that succeeded — the stream does not separate the good days from the bad ones, it just keeps both.
04 — Actors
The actor table makes non-human activity visible: automations with perfect failure records, service accounts with elevated paths, break-glass principals with their own chip. Risk is scored per actor, and last-seen dates the row.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Owns the retention board: 15 gaps against the floor, the identity log 45 days short of 90, and the assurance score they report upward.
retention gaps · 15
Owns the anomaly board — 19 high-risk findings, the off-hours burst, the break-glass assignment without a ticket — and the review that follows.
high risk · 19
Owns source coverage: 24 sources, 6 passing validation, and the digest windows that went missing for two hours.
sources healthy · 6/24The shape of it
Every figure below is legible in the captures above. Nothing here is a projection of your estate — it is the state of the demo data.
How it runs
Twenty-four sources write into one stream — cloud API, identity, code platform, SaaS, endpoint, network — each validated on arrival.
Events chain into a digest; integrity passes 72% today, and the two-hour gap in one fleet's digest window is an alert, not a shrug.
Anomaly and retention models run over the stream: 48 trails, 24 sources, 72 findings ranked by score.
Retention is checked against floors, not set-and-forgotten — the log 45 days under its 90-day floor is the finding that proves the check runs.
One record
Every admin-class action in the other products is an event here — the trail is how the estate explains itself later.
Sign-ins, role assumes and policy updates are the identity events in this stream — 124 admin-class events in the demo week came from somewhere.
CEDX AdminSeat grants, role edits and workspace changes are admin-class events; the off-hours burst alert is exactly this traffic.
CEDX DirectoryLifecycle events — joins, moves, leaves — are the directory's contribution to the stream, and leavers past SLA show up in both consoles.
CEDX SiemThe scored anomalies and actor risk profiles here are the signals a security operations view correlates further.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your sources, your floors
Audit with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/audit. It runs on demo data, which the page says next to the figures rather than in a footnote.
The trail's own trustworthiness: integrity pass rate (72% on the digest chain), source validation (6 of 24 healthy), admin-class volume and high-risk findings. It reads 47 in the demo — the product grading its own coverage before anyone else grades it.
A source keeping less than its configured floor — 15 in the demo, topped by an identity production log at 45 days against a 90-day floor. Nothing was deleted maliciously; the configuration just drifted, which is what most audit findings actually look like.
Forty-eight anomaly trails run over the stream: off-hours admin bursts, impossible travel, bulk exports, log-delete attempts. Each finding carries actor, source, severity and a score — the risk board tops out at 89 in the demo week.
Config and privilege changes — 124 of the 320 demo events: policy updates, role assumes, group membership changes, secret operations. They are counted separately because they are the events an assessor asks about first.
No certification has been issued for any CEDX product, Audit included — which this page states in its limits. What we can evidence about hosting, encryption, tenant isolation and production access is written up on the security page.
Live build, demo data, no card. Then ask how many days of your own admin log you could actually produce.