Skip to main content
Every security event that Recon44 records — blocked requests, IP rule changes, login attempts, configuration edits — is written to an immutable, hash-chained audit log. You can export these logs at any time to satisfy evidence requests from auditors for SOC2 Type II, ISO 27001, or internal security reviews. Audit logs are available on Business plans and above.

​
What the audit log contains

Each audit log entry records the following fields:
  • Timestamp — exact date and time of the event (UTC)
  • Event type — for example, request.blocked, ip.blocklisted, rule.created, user.login
  • Source IP — the IP address involved in the event
  • Target — the resource or endpoint affected
  • Action taken — what Recon44 did (blocked, flagged, allowed, modified)
  • Actor — the dashboard user who triggered the event, for configuration changes
  • Hash — the SHA-256 hash of this entry chained to the previous entry

​
What “hash-chained” means for compliance

Each log entry includes the cryptographic hash of the entry before it. This creates a chain: if any record is deleted or modified after the fact, the hashes no longer match and tampering is immediately detectable.
Auditors familiar with blockchain-style evidence chains will recognize this pattern. You can present the chain integrity as evidence that log records have not been altered since they were written.
This property is required for several SOC2 Type II trust service criteria (specifically CC7.2 and CC7.3 around monitoring and anomaly detection) and for ISO 27001 Annex A control A.12.4 (logging and monitoring). Recon44’s export includes the full hash chain so your auditor can verify integrity independently.

​
Retention by plan

Free

7-day log retention. Audit log export is not available.

Pro

30-day log retention. Audit log export is not available.

Business

90-day log retention with full audit log export for SOC2 and ISO 27001 compliance.

Scale and Enterprise

Unlimited log retention. Audit log export included. Suitable for multi-year audit windows.
If you are mid-audit and realize your current plan does not cover the required retention window, upgrading your plan does not recover logs from before the upgrade. Plan ahead and upgrade before your audit window begins.

​
Export audit logs

1

Open the Audit Log page

In the dashboard, go to Compliance → Audit Logs from the left sidebar. You will see a filterable table of all recorded events within your plan’s retention window.
2

Set your date range

Use the Date range picker to select the period your audit covers. For SOC2 Type II audits, this is typically a 6- or 12-month window. For ISO 27001 surveillance audits, match the period specified by your certification body.
3

Apply filters (optional)

Narrow the export to specific event types using the Event type filter. For example, select only request.blocked and ip.blocklisted events if your auditor only needs WAF evidence. Leave filters clear to export all event types.
4

Choose an export format

Click Export and choose a format from the dropdown:
  • JSON — machine-readable, includes full hash chain, recommended for auditors who will verify integrity programmatically
  • CSV — spreadsheet-compatible, suitable for manual review and attaching to audit reports
  • PDF — formatted report, suitable for directly attaching to audit evidence packages
5

Download the file

Click Download. The file is generated and downloaded immediately. Large exports (over 100,000 events) are prepared asynchronously and you will receive an email with a download link within a few minutes.
6

Verify the hash chain (optional)

If your auditor asks you to verify integrity, open the JSON export and confirm that the previous_hash field of each entry matches the hash field of the entry immediately before it. Any mismatch indicates tampering.

​
Using logs as audit evidence

SOC2 Type II audits assess whether your security controls operated effectively over a defined period. Recon44 audit logs provide direct evidence for:
  • CC6.6 — logical access controls (IP blocking rules, login events)
  • CC6.8 — controls over malicious software and attacks (WAF block events)
  • CC7.2 — monitoring system components for anomalies (all event types)
  • CC7.3 — evaluating security events and disclosing information to affected parties
Export logs covering your entire audit period and include them in your evidence package alongside the hash chain verification.
ISO 27001 audits map to Annex A controls. Recon44 logs provide evidence for:
  • A.12.4.1 — event logging (complete event log with timestamps)
  • A.12.4.2 — protection of log information (hash-chained tamper evidence)
  • A.12.4.3 — administrator and operator logs (configuration change events)
  • A.13.1.1 — network controls (WAF and IP blocking events)
Export in JSON format so your auditor can independently verify the hash chain.
For internal reviews, use the CSV export to build reports in Excel or Google Sheets. Filter by event type to produce summaries such as “total blocked requests by month” or “IP addresses blocked most frequently.”
Schedule a regular export — for example, monthly — rather than waiting until your audit. This ensures you have a local backup even if you change plans, and makes the final evidence package easy to assemble.