mcpField
A
admin-audit-log-review

admin-audit-log-review

github.com/sylphxaiSecurity135 installsUpdated today
Repository

About admin-audit-log-review

A skill for teams designing administrator audit logs and addressing privileged actions, security evidence, and customer traceability. It classifies events and produces plans with owners, gates, metrics, and recovery paths.

Key features

  1. 01Identify admin actions and logging gaps
  2. 02Classify audit events
  3. 03Define event schema, retention, and integrity controls
  4. 04Plan customer access, exports, and alerts
  5. 05Produce designs, checklists, and rollout plans

Use cases

  1. 01Plan logging coverage for privileged actions
  2. 02Design retention and tamper-evident controls
  3. 03Plan customer audit views and exports

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sylphxai/skills --skill admin-audit-log-review

After installing, type/admin-audit-log-reviewin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/admin-audit-log-patterns.md

Details

From the project README

Admin Audit Log Review

Use this skill to convert admin audit log, privileged action, security evidence, retention, SIEM, and customer traceability questions into a concrete artifact with owners, gates, metrics, and recovery paths.

Workflow

  1. Identify admins, privileged actions, enterprise requirements, data/security impact, retention needs, customer visibility, SIEM/export needs, and current logging gaps.
  2. Read references/admin-audit-log-patterns.md.
  3. Classify events as identity/admin, role/permission, billing, security, integration/API token, data export/delete, configuration, policy, support access, or system-generated change.
  4. Define event contract, actor/target/context, retention, integrity controls, customer UI, export/API, alerting, privacy redaction, and support/audit workflow.
  5. Produce audit-log design, state machine, decision table, event schema, coverage checklist, and rollout/backfill plan.

When not to use

  • Do not use for generic advice the base model already handles without this skill's specific artifact contract.

Guardrails

  • Do not log secrets, raw sensitive content, tokens, or unnecessary PII in audit logs.
  • Do not let admins alter or delete audit evidence without separate tamper-evident controls.
  • Do not claim audit-log coverage unless critical privileged actions are actually emitted and queryable.
  • Do not make audit logs unusable for customers by omitting actor, target, timestamp, result, source, and correlation context.

Output format

Audit log context:
Audience / source of truth / risk boundary:

Admin audit-log plan:
| Area | Decision | Evidence | Risk | Owner |
| --- | --- | --- | --- | --- |

Event coverage, retention, customer access, and alerts:
- <trigger> -> <policy, metric, edge case, support note>

Comments

Markdown supported