Collect, seal, search, hand over.
Four jobs, done for every admin event in your stack. Here is how each one works.
Collection from the APIs vendors already publish
Each connector uses the vendor's official audit interface with read-only scopes. If a vendor call fails, PhotonPeak retries with backoff and records the gap, so a missing window is visible instead of silent.
Custom events from your own admin tools arrive over HTTPS with a scoped ingest key and go through the same normalization.
- Events
- Sources
- Rules
- Evidence packs
- Auditors
Sources
6 connected
Connectors
| Source | Interval | Health |
|---|---|---|
| Microsoft 365 Entra ID, Exchange, SharePoint | 15 min | Healthy |
| Google Workspace admin, login, drive | 15 min | Healthy |
| Okta System Log | 5 min | Healthy |
| GitHub Enterprise audit log | 5 min | Retrying |
| AWS CloudTrail Management events | 5 min | Healthy |
Tamper-evident by construction
Every stored event gets a SHA-256 hash computed over its content and the hash of the event before it. Change or remove one record and every hash after it stops matching.
- Daily checkpoints are published to your workspace and embedded in evidence packs.
- Write-once storage keeps records locked for the retention period you pick.
- Offline verification with the open CLI works on any JSON Lines export, no PhotonPeak login required.
$ photonpeak verify ./export-2026-q3.jsonl --checkpoints ./checkpoints.jsonReading 1,284,519 events (2026-07-01 to 2026-09-30)Checking 92 daily checkpoints✓ Chain intact: first 9f2c…a41e, last 03bd…7c90✓ All checkpoints match0 gaps, 0 mismatches
Search, then package it as evidence
Auditors usually ask questions like "show every change to administrator roles in Q3". Filter by action category, person, source and date, then save the query as an evidence pack.
An evidence pack contains the matching events as CSV and JSON Lines, a PDF summary with the query, time range and row count, and the chain checkpoints that cover that range.
- Events
- Sources
- Rules
- Evidence packs
- Auditors
Q3 privileged role changes
2026-07-01 to 2026-09-30
- Matching events
- 214
- Sources
- 3
- Chain check
- Pass
- 92 checkpoints
Sample rows
| Action | Date |
|---|---|
| Add member to role Global Administrator | 2026-09-18 |
| ASSIGN_ROLE Super Admin | 2026-08-04 |
| group.user_membership.add Okta Administrators | 2026-07-22 |
Rules for the changes that matter
Starter rules cover the settings attackers and careless admins touch first. Alerts go to email or a webhook (Slack incoming webhook, Microsoft Teams workflow, or your own endpoint) within minutes of the event being ingested.
- Privileged role assigned or removed
- MFA or 2-Step Verification disabled
- CloudTrail logging stopped or trail deleted
- External sharing or forwarding turned on
- Branch protection removed on a default branch
- New OAuth app granted tenant-wide consent
Rule activity today
- Logging stopped CloudTrail StopLogging in us-east-1 09:21 UTC · webhook sent
- Branch protection protected_branch.destroy on main 11:03 UTC · email sent
- Privileged role Global Administrator assigned 16:42 UTC · acknowledged
Auditor access without sharing admin logins
Invite an external auditor with a read-only seat limited to chosen sources and a date range. The seat expires automatically, and every search the auditor runs is itself logged.
Forward to your SIEM
On Growth and Enterprise, normalized events stream to Splunk HTTP Event Collector or Microsoft Sentinel. PhotonPeak stays the long-term, verifiable copy while your SIEM handles correlation.
Compare plans