Exporting audit evidence
Verify the hash chain, then export a scoped range in JSON, CSV, or CEF for a control test or a SIEM.
An export is only worth as much as the chain behind it — verify first, so the export you hand to an auditor is backed by a check you ran yourself, not an assumption.
Verify before you export
$ cirvix audit verify chain intact 43675 records verified Verification proves records were not altered after they were written. It does not attest to their content.Export a scoped range
$ curl -s "$CIRVIX_API/v1/export?format=csv&since=2026-08-01&until=2026-08-31" \ -H "authorization: Bearer $TOKEN" > q3-access-review.csv $ # CEF for a SIEM — ingested without a custom parser:$ curl -s "$CIRVIX_API/v1/export?format=cef&since=2026-08-01" \ -H "authorization: Bearer $TOKEN" > decisions.cefcirvix audit verify checks the chain an endpoint wrote locally. GET /v1/audit/verify checks the tenant's chain on the control plane. They are separate chains covering separate records, and an access review usually wants the second.
Mapping to a control
| Control area | What the export shows |
|---|---|
| Access review | Decision and approver records — who did what, and who signed off |
| Change management | Policy versions, draft reviews, and hash-bound approvals |
| Logging and monitoring | The hash-chained decision log itself |
| Incident response | cirvix why and cirvix replay output for the specific run |
Note
This is not a certification. Exports are formatted to match what a control test looks for; whether your controls pass is a conclusion your auditor reaches, not a claim Cirvix makes. See Security.
Streaming continuously instead
For a SIEM, GET /v1/export emits decisions as JSON, CSV, or CEF. ArcSight CEF is ingested by every SIEM without a custom parser, so the same evidence lands in Splunk, Sentinel, or Chronicle without writing one.
Edit this page on GitHub
Was this page helpful?