# Administration — Audit & Security

![Administration — Audit & Security](/docs-content/96a90ffbe8-07-audit-and-security.png.webp)

**Navigation:** Administration → Audit & Security  
**Access:** security, audit, or designated governance permission  
**Primary audience:** security operations, internal audit, governance, and authorized investigators

## Purpose

Audit & Security provides the cross-platform record of security, policy, access, connector, export, and external-write events. It supports investigation and control assurance while distinguishing unusual or blocked activity from confirmed security incidents.

## Scope controls and indicators

Period limits event time. Environment filters the deployment environment. Severity selects event impact. Investigation filters open, closed, or all cases.

Security Events shows relevant event volume. Open Investigations counts active inquiries. Policy Decisions reports authorization or control evaluations. External Writes counts governed changes attempted or completed in connected systems.

## Security and policy events

Each row shows time, event, severity, actor or service, object, control, outcome, and investigation link. Typical events include blocked export, connector token rotation, unusual access, successful or denied external write, and policy decision.

## Investigation panel

The selected investigation displays event statement, affected object, observed evidence, current assessment, control response, related events, owner, and next step. The screen uses language such as requires investigation until a security decision is recorded.

## Control posture and evidence

Control Posture reports privileged review, audit integrity, connector credential, destination checks, and other configured controls. **Security event mix** groups activity. **Control evidence** provides checksums, reason-code coverage, destination validation, and related assurance. **Security actions** lists investigation, rotation, and audit-export work.

## Actions

- Filter and open an event.
- Start, assign, update, or close an investigation.
- Rotate a connector credential through the approved flow.
- Open a policy decision or external-write record.
- Export a governed audit package.
- Link related events and record an assessment.

## Recommended procedure

Validate event source, identity, object, and control outcome. Distinguish blocked attempts, anomalies, policy violations, and confirmed incidents. Preserve evidence and timeline, then follow the appropriate incident or audit process.

## Related screens

[Reviewer Audit](/documentation/packages/bnd-ethics/screens/intelligence-ethics-reviewer-audit), [People & Access](/documentation/packages/bnd-org/screens/administration-people-and-access), [Governance](/documentation/packages/bnd-org/screens/administration-governance), and [Platform Operations](/documentation/packages/bnd-aiops/screens/administration-platform-operations).