# noust audit

Read, verify, export and review the audit log.

```bash
noust audit [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`events`](#noust-audit-events), [`export`](#noust-audit-export), [`list`](#noust-audit-list), [`prune`](#noust-audit-prune), [`recording`](#noust-audit-recording), [`recordings`](#noust-audit-recordings), [`review`](#noust-audit-review), [`ship`](#noust-audit-ship), [`show`](#noust-audit-show), [`status`](#noust-audit-status), [`verify`](#noust-audit-verify)

## noust audit events

List every event the audit log can record.

```bash
noust audit events [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--markdown` | Print the Markdown table docs/ENS.md includes. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit export

Export the audit log for a period, for an auditor or a SIEM.

```bash
noust audit export [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--since` | From this date (YYYY-MM-DD) or timestamp. |  |
| `--until` | Up to this date (YYYY-MM-DD) or timestamp, inclusive. |  |
| `-o`, `--output` | Write to this file (created 0600) instead of standard output. |  |
| `--format` | NDJSON keeps every field and the chain; CSV is for a spreadsheet. | `ndjson` |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit list

List audit events, newest first.

```bash
noust audit list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-n`, `--limit` | Most events shown. | `50` |
| `--action` | Only this event, such as apps.delete. |  |
| `--actor` | Only this actor, as shown in the Actor column. |  |
| `--result` | Only this outcome, such as denied. |  |
| `--category` | Only this category, such as access or change. |  |
| `--correlation` | Only the events of one request, command or job. |  |
| `--since` | Only events from this date (YYYY-MM-DD) on. |  |
| `--json` | Print the events as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit prune

Apply retention now: old audit files and Noust's other records past their period.

```bash
noust audit prune [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was deleted as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit recording

Show one recorded terminal session.

```bash
noust audit recording [OPTIONS] RECORDING_ID
```

Arguments: `recording_id`

| Option | What it does | Default |
|---|---|---|
| `--format` | text: what was printed and typed, with the programs' escape sequences removed. cast: the asciicast file, which any asciinema player plays. | `text` |
| `--no-input` | With --format text, leave out what was typed. |  |
| `--json` | Print the recording, its events and its verdict as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit recordings

List the recordings of terminal sessions, newest first.

```bash
noust audit recordings [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `-n`, `--limit` | Most recordings shown. | `50` |
| `--app` | Only the sessions in this application. |  |
| `--actor` | Only the sessions of this person, as the Actor column shows them. |  |
| `--kind` | Only an application's or the server's. |  |
| `--json` | Print the recordings as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit review

Record that you reviewed the audit log for a period (ENS op.exp.8.r1).

```bash
noust audit review [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--from` | First day reviewed (YYYY-MM-DD). |  |
| `--to` | Last day reviewed (YYYY-MM-DD). |  |
| `--notes` | What was looked at and what was found. | `` |
| `--list` | List the reviews recorded so far. |  |
| `--json` | Print the review as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit ship

Send what each destination has not received yet (for a timer without the console).

```bash
noust audit ship [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what was shipped as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit show

Show one event in full, by sequence number or id.

```bash
noust audit show [OPTIONS] EVENT
```

Arguments: `event`

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the event as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit status

Say whether the audit trail works and where it is shipped.

```bash
noust audit status [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the report as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust audit verify

Check the audit chain and report the first broken link.

```bash
noust audit verify [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the result as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |