noust audit
Read, verify, export and review the audit log.
Shell
noust audit [OPTIONS] COMMAND [ARGS]...Subcommands: events, export, list, prune, recording, recordings, review, ship, show, status, verify
noust audit events
List every event the audit log can record.
Shell
noust audit events [OPTIONS]| Option | What it does | Default |
|---|---|---|
--markdown |
Print the Markdown table docs/ENS.md includes. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit export
Export the audit log for a period, for an auditor or a SIEM.
Shell
noust audit export [OPTIONS]| Option | What it does | Default |
|---|---|---|
--since |
From this date (YYYY-MM-DD) or timestamp. | |
--until |
Up to this date (YYYY-MM-DD) or timestamp, inclusive. | |
-o, --output |
Write to this file (created 0600) instead of standard output. | |
--format |
NDJSON keeps every field and the chain; CSV is for a spreadsheet. | ndjson |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit list
List audit events, newest first.
Shell
noust audit list [OPTIONS]| Option | What it does | Default |
|---|---|---|
-n, --limit |
Most events shown. | 50 |
--action |
Only this event, such as apps.delete. | |
--actor |
Only this actor, as shown in the Actor column. | |
--result |
Only this outcome, such as denied. | |
--category |
Only this category, such as access or change. | |
--correlation |
Only the events of one request, command or job. | |
--since |
Only events from this date (YYYY-MM-DD) on. | |
--json |
Print the events as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit prune
Apply retention now: old audit files and Noust's other records past their period.
Shell
noust audit prune [OPTIONS]| Option | What it does | Default |
|---|---|---|
--json |
Print what was deleted as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit recording
Show one recorded terminal session.
Shell
noust audit recording [OPTIONS] RECORDING_IDArguments: recording_id
| Option | What it does | Default |
|---|---|---|
--format |
text: what was printed and typed, with the programs' escape sequences removed. cast: the asciicast file, which any asciinema player plays. | text |
--no-input |
With --format text, leave out what was typed. | |
--json |
Print the recording, its events and its verdict as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit recordings
List the recordings of terminal sessions, newest first.
Shell
noust audit recordings [OPTIONS]| Option | What it does | Default |
|---|---|---|
-n, --limit |
Most recordings shown. | 50 |
--app |
Only the sessions in this application. | |
--actor |
Only the sessions of this person, as the Actor column shows them. | |
--kind |
Only an application's or the server's. | |
--json |
Print the recordings as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit review
Record that you reviewed the audit log for a period (ENS op.exp.8.r1).
Shell
noust audit review [OPTIONS]| Option | What it does | Default |
|---|---|---|
--from |
First day reviewed (YYYY-MM-DD). | |
--to |
Last day reviewed (YYYY-MM-DD). | |
--notes |
What was looked at and what was found. | `` |
--list |
List the reviews recorded so far. | |
--json |
Print the review as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit ship
Send what each destination has not received yet (for a timer without the console).
Shell
noust audit ship [OPTIONS]| Option | What it does | Default |
|---|---|---|
--json |
Print what was shipped as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit show
Show one event in full, by sequence number or id.
Shell
noust audit show [OPTIONS] EVENTArguments: event
| Option | What it does | Default |
|---|---|---|
--json |
Print the event as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit status
Say whether the audit trail works and where it is shipped.
Shell
noust audit status [OPTIONS]| Option | What it does | Default |
|---|---|---|
--json |
Print the report as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |
noust audit verify
Check the audit chain and report the first broken link.
Shell
noust audit verify [OPTIONS]| Option | What it does | Default |
|---|---|---|
--json |
Print the result as JSON. | |
--reason |
Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |