Audit Logging

Reference playbook for centralized audit logging, SIEM forwarding, and compliance log retention.

Tested · Works

Test report

Verdict
Tested · Works
Score
9.6/10
Tested
Jul 14, 2026
Environment
Claude Code 2.x (agent harness)
Upstream re-checked
Aug 10, 2026 · 22cb2e0

Asked it to add SOC2-compliant login audit logging to a Flask app and it pulled the bundled hash-chained AuditLogger class plus the exact SOC2/HIPAA/PCI-DSS retention figures (1yr/6yr/1yr) verbatim, well past the baseline's generic 'log to a file and forward to your SIEM' answer.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

  • Installs cleanly 5/5
  • Triggers reliably 5/5
  • Output vs. baseline 9/10
  • Docs & honesty 5/5

What Audit Logging does

A reference playbook for implementing centralized audit logging: rsyslog/journald forwarding configs, a Python AuditLogger class with hash-chained tamper detection, Fluentd/Fluent Bit pipelines, an Elasticsearch ILM retention policy, and a SOC2/HIPAA/PCI-DSS/GDPR/FedRAMP retention-period table. Triggers when implementing audit trails, SIEM integration, or compliance-driven log retention. Ships as copy-paste config and code rather than an installer or script to run.

How to install Audit Logging

git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills
cd DevOps-Security-Agent-Skills
mkdir -p ~/.claude/skills
cp -r compliance/auditing/audit-logging ~/.claude/skills/audit-logging

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Audit Logging

  • /audit-logging Reference playbook for centralized audit logging, SIEM forwarding, and compliance log retention.

It also activates on plain-language prompts like these:

  • Set up centralized audit logging with SIEM integration for SOC2.
  • I need an audit trail for our app with a HIPAA retention policy.
  • How do I configure log retention and monitoring for PCI DSS?

Frequently asked questions

Is the Audit Logging skill free?
Yes. The skill itself is free from BagelHole/DevOps-Security-Agent-Skills. SkillProof publishes the install command and an independent test verdict at no cost.
Does Audit Logging work with Claude Code?
We tested it with Claude Code 2.x (agent harness) on Jul 14, 2026. Verdict: Tested · Works. Asked it to add SOC2-compliant login audit logging to a Flask app and it pulled the bundled hash-chained AuditLogger class plus the exact SOC2/HIPAA/PCI-DSS retention figures (1yr/6yr/1yr) verbatim, well past the baseline's generic 'log to a file and forward to your SIEM' answer.
What is the Audit Logging SkillProof Score?
9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
How do I install Audit Logging?
Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Audit Logging with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.