Log Intelligence

When logs are summarized, Auditty indexes the varying correlation keys under a single ids object — one entry per searchable id. An id is a declared identity key, a shape-detected key (uuid, hex trace/RayID, prefixed id, long token, ip, MAC, JWT), or a value under an id-ish key name. Bare magnitudes and dimensions (bytes_sent, duration_ms, status, method) are context — kept losslessly in the Vault, not listed in ids. Every id maps directly to an array of its complete distinct values — a window holds up to 50 distinct identity groups, then rolls to a new summary, so ids are enumerated in full rather than sampled. Every id is searchable, and the exact originals — including the excluded fields — stay one click away via backfill_url:

JSON:

{
  "message": "DNS query",
  "auditty": {
    "suppressed": 100,
    "window": { "start": "2026-01-15T09:00:00Z", "end": "2026-01-15T09:05:00Z" },
    "duration": "5m0s",
    "fingerprint": "a1b2c3d4",
    "class": "network",
    "namespace": "prod",
    "workload": "dns-proxy",
    "ids": {
      "dest_ip": ["10.0.10.1"],
      "src_ip":  ["10.0.1.5", "10.0.1.12", "10.0.1.20", "10.0.1.33", "10.0.1.41"]
    },
    "backfill_url": "https://<your-hivemind-url>/backfill/replay?token=<TOKEN>&sig=<SIG>"
  }
}

Reading the summary: 100 DNS queries collapsed into one line. Every suppressed query went to dest_ip: 10.0.10.1 (a single-element array) and originated from five distinct sources — src_ip lists all of them. Each id maps directly to an array of its complete distinct values; nothing is sampled away. Non-id context (query names, byte counts) is not indexed here but is preserved in full — replay the exact originals via the backfill_url.

Plain text:

DNS query for <str> took <decimal> ms [auditty: suppressed 100 over 5m (09:00:00-09:05:00) | namespace:prod | workload:dns-proxy | fingerprint:a1b2c3d4 | dest_ip=10.0.10.1 | src_ip=10.0.1.5,10.0.1.12,10.0.1.20,10.0.1.33,10.0.1.41 | backfill_url:https://…]

Each id appears once — declared identity keys, shape-detected ids, and values under id-ish key names; magnitudes and dimensions are kept in the Vault, not indexed here. Every id maps directly to an array of its complete distinct values. No occurrence count is attached to a value, so a unique identifier never looks like it recurred:

"ids": {
  "user_id":  ["user_17", "user_42", "user_88"],
  "trace_id": ["abc123", "def456", "ghi789"],
  "src_ip":   ["10.0.0.1", "10.0.0.2", "10.0.0.3"]
}

Every id is searchable: auditty.ids.user_id:user_42, auditty.ids.src_ip:10.0.0.3. Summaries stay bounded because a window holds at most 50 distinct identity groups before it rolls to a new summary — so even a unique-per-event id (e.g. a per-request trace id) is enumerated in full across summaries rather than sampled. The complete set for any window is also one click away via the backfill URL.

On the Insights page, look for cards titled Reliable precursor in <workload>: N× → rate spike. Each card tells you the precursor pattern, how many times it has preceded a rate spike, and the average lead time. Treat the next firing of that pattern as an early warning — the spike usually follows within seconds to minutes.

Correlations store fingerprints (opaque hashes), not log content. Raw correlation rows are kept for 180 days; the daily summary used by the Insights query is kept for 365 days. Both are tenant-isolated.

1. Edge archives suppressed logs to your cloud storage (S3/GCS/Azure)
2. Every suppression summary contains a backfill_url signed locally by Edge API
3. Open the URL — Auditty validates the token, fetches the archived data, and shows the original logs
4. No extra tooling or credentials needed