AuditLog

Experimental

AuditLog records results from an audit performed against a target resource

criteria array[ArtifactMapping] Required

criteria defines the acceptable state for the audited resource

metadata object Required

metadata provides detailed data about this log

results array[AuditResult] Required

results records audit results against the criteria

summary string Required

summary provides the high-level conclusion

target Resource Required

target identifies the resource being evaluated

owner RACI

owner defines the RACI roles responsible for managing the audit

ResultType

ResultType classifies the nature of an audit result

  • Type: string

AuditResult

Experimental

AuditResult records a single result with supporting evidence and recommendations.

criteria-reference MultiEntryMapping Required

criteria-reference maps this result to specific criteria entries

description string Required

description explains the result in detail

id string Required

id uniquely identifies this result

title string Required

title describes this result at a glance

type ResultType Required

type classifies the nature of this result

evidence array[Evidence]

evidence records the data sources that support this result

recommendations array[Recommendation]

recommendations records corrective actions for this result

Recommendation

Experimental

Recommendation provides a corrective action for an audit result

text string Required

text describes the recommended corrective action

id string

id uniquely identifies this recommendation

required boolean

required indicates whether this recommendation is a mandatory corrective action

Evidence

Experimental

Evidence records what was cited to support an opinion for a specific activity: raw data for the evaluation layer, evaluation and enforcement artifacts for the audit layer. At least one of payload or source MUST be present; an entry with neither is semantically incomplete.

collected-at Datetime Required

collected-at is the timestamp when the evidence was gathered

id string Required

id uniquely identifies this evidence

type EvidenceType Required

type categorizes the kind of evidence

description string

description explains what this evidence represents

payload

payload is the raw evidence data collected inline

source EvidenceMapping

source identifies the artifact or system from which this evidence was collected

EvidenceType

EvidenceType categorizes the kind of evidence. It remains an open enum: recommended values include artifact types already known to Gemara (e.g. EvaluationLog, EnforcementLog) plus categories for common evidence forms.

  • Type: string