Audit Logging
Reference playbook for centralized audit logging, SIEM forwarding, and compliance log retention.
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 14, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 22cb2e0
Asked it to add SOC2-compliant login audit logging to a Flask app and it pulled the bundled hash-chained AuditLogger class plus the exact SOC2/HIPAA/PCI-DSS retention figures (1yr/6yr/1yr) verbatim, well past the baseline's generic 'log to a file and forward to your SIEM' answer.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 9/10
- Docs & honesty 5/5
What Audit Logging does
A reference playbook for implementing centralized audit logging: rsyslog/journald forwarding configs, a Python AuditLogger class with hash-chained tamper detection, Fluentd/Fluent Bit pipelines, an Elasticsearch ILM retention policy, and a SOC2/HIPAA/PCI-DSS/GDPR/FedRAMP retention-period table. Triggers when implementing audit trails, SIEM integration, or compliance-driven log retention. Ships as copy-paste config and code rather than an installer or script to run.
How to install Audit Logging
git clone https://github.com/BagelHole/DevOps-Security-Agent-Skills
cd DevOps-Security-Agent-Skills
mkdir -p ~/.claude/skills
cp -r compliance/auditing/audit-logging ~/.claude/skills/audit-logging
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Audit Logging
-
/audit-loggingReference playbook for centralized audit logging, SIEM forwarding, and compliance log retention.
It also activates on plain-language prompts like these:
-
Set up centralized audit logging with SIEM integration for SOC2. -
I need an audit trail for our app with a HIPAA retention policy. -
How do I configure log retention and monitoring for PCI DSS?
Frequently asked questions
- Is the Audit Logging skill free?
- Yes. The skill itself is free from BagelHole/DevOps-Security-Agent-Skills. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Audit Logging work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 14, 2026. Verdict: Tested · Works. Asked it to add SOC2-compliant login audit logging to a Flask app and it pulled the bundled hash-chained AuditLogger class plus the exact SOC2/HIPAA/PCI-DSS retention figures (1yr/6yr/1yr) verbatim, well past the baseline's generic 'log to a file and forward to your SIEM' answer.
- What is the Audit Logging SkillProof Score?
- 9.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 9/10, docs & honesty 5/5.
- How do I install Audit Logging?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Audit Logging with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.