# Audit Trail, Logging & SIEM Integration

> Source: https://agilitycms.com/docs/owners-admins/audit-trail-logging-and-siem-integration

Agility records content-level activity through **version history** and a **Recent Changes report**, which capture who changed a content item or page, what changed, and when — giving editors and administrators a reviewable trail of content modifications and the ability to revert to any prior version. **Versions are immutable and retained indefinitely.** At the platform level, Agility operates on Microsoft Azure with operational audit logging and environment separation. Agility does **not** offer a native, packaged SIEM connector; to forward content-change events into a customer's logger (Azure Monitor, Splunk, etc.), the implementation partner builds a small **webhook handler** that pushes each event into the customer's pipeline. In most deployments the observability that matters most — monitoring the live site/app, including its calls to Agility's content APIs — is provided natively by the customer's **front-end hosting platform**, which is the primary place that telemetry is captured.

## What is captured today

- **Content & page version history.** Every change creates a version; the history shows the modification, the user who made it, the timestamp, and the workflow state of that version. Administrators/editors can view and **restore** prior versions. **Versions are immutable and retained indefinitely**, so the full change history of an item is always available and cannot be altered after the fact.
- **Recent Changes report.** A built-in **Recent Changes** report surfaces content that has been changed and **by whom**, giving administrators a cross-item view of recent activity rather than having to open each item's history individually.
- **Workflow state transitions.** Content moves through staging/approval/publish states, and these states are visible per version.
- **Platform operational logs.** Azure-level operational logging and monitoring underpin the service (used by Agility operations).

**Scope note.** Agility's reviewable activity records center on **content** — version history (immutable, retained indefinitely) and the Recent Changes report. A dedicated customer-facing **administrative/security event log** (logins, permission/role changes, API-key issuance) is not exposed today; authentication events are typically captured in the customer's identity provider (e.g. Microsoft Entra), and application/security events at the front-end hosting layer.

## Export to SIEM (Azure Monitor, Splunk, etc.)

**Agility does not provide a native, turnkey SIEM connector today.** To push Agility events into a customer's logger/SIEM, the implementation partner builds a small **webhook handler**: Agility fires a webhook on an event, the handler receives it and forwards it into the customer's logging pipeline (Azure Event Hubs / Monitor / Sentinel, Splunk HEC, etc.). This is a straightforward integration, but it is **partner-built, not out-of-the-box** — be explicit about that with a security reviewer rather than implying a packaged connector exists.

**Webhook events available** cover the key auditable actions:

- Changes to **content** and **pages**
- **Workflow actions**
- **Publish, unpublish, and delete** operations

```text
Agility event (content published, item changed, workflow transition, etc.)
        │  (webhook)
        ▼
Custom handler (partner-built)  ──►  Azure Event Hub / Function / Splunk HEC
        │
        ▼
SIEM (Azure Monitor / Sentinel / Splunk) — correlation, alerting, retention
```

### The bigger picture: most observability lives at the front-end/hosting layer

In practice, what enterprises most often want to monitor is the **running website or application**, and that telemetry already exists at the hosting layer. Modern hosting platforms (Vercel, Netlify, Azure, etc.) almost always include logging, metrics, and observability out of the box — including **request traces and outbound API-call dependencies**, which means they can already capture the application's calls to Agility's content APIs (latency, errors, volume). For most monitoring requirements, this front-end/hosting observability is the primary, native answer, and the webhook-to-SIEM handler above is a complementary path specifically for *content-change auditing* inside Agility.

## Shared responsibilities

| Area | Agility | Implementation partner / customer |
| --- | --- | --- |
| Content/page version history | ✅ Captures who/what/when; supports revert | ✅ Reviews history as part of governance |
| Admin/security event logging | Content activity via version history + Recent Changes; no dedicated customer-facing admin/security event log | ✅ Uses IdP + hosting logs for auth/security events |
| Immutability & retention of records | ✅ Versions immutable, retained indefinitely | ✅ Maps to its own retention requirements |
| Content-change event source for SIEM | ✅ Provides webhooks (content/page changes, workflow actions, publish/unpublish/delete); no native SIEM connector | ✅ Builds the webhook handler + SIEM pipeline (Azure Monitor/Splunk), retention, alerting |
| Live app/site observability (incl. calls to Agility APIs) | ✅ Provides the content APIs being called | ✅ Uses front-end hosting observability (Vercel/Netlify/Azure) to trace requests + API dependencies |
| Forensic/incident requests | ✅ Platform-level logs (Agility operations) | ✅ Application-level logs for its own front end |