Verifying audit exports with keenauth audit verify

keenauth audit verify checks a management audit export on your own machine. It does not contact KeenAuth, needs no API key and no keenauth login session, so you do not have to trust the platform to trust the export.

What it proves

The command takes the export bundle you downloaded (a tar file with records.ndjson.gz, manifest.json and manifest.jws) and the regional audit-jwks.json. It then:

  1. checks the signature of manifest.jws with the audit checkpoint key and that manifest.json is its payload;
  2. checks the size and SHA-256 of records.ndjson.gz against the manifest;
  3. recomputes the hash of every record, and checks that the sequence numbers are consecutive and every record points to the hash of the previous one;
  4. rebuilds the leaf of each hour and follows its inclusion proof (RFC 9162) to the root of the signed hourly checkpoint.

So it proves that the records in the bundle were not changed, removed or reordered. It does not prove that your filters were applied correctly. The leaf contains the environment ID, so a proof for another environment does not hold for your records.

Usage

keenauth audit verify --bundle audit-export.tar --jwks audit-jwks.json --environment-id 0192b6f0-7c1e-7a55-8f3d-2a6f0e9d4b11
Flag Description
--bundle Path of the downloaded export bundle (required).
--jwks Path of the regional audit-jwks.json (required).
--environment-id Environment ID (UUID) the bundle must belong to. Recommended: without it the command prints a warning and does not check the environment.
--output, -o table, json or yaml. Without the flag the CLI prints a table on a terminal and JSON otherwise.

On success the command prints a summary (verified, export_id, environment_id, cell, stream, from, to, record_count, line_count, windows, key_id, include_ip) and exits with code 0. record_count counts the records that match your filter; line_count also counts the placeholder lines for records outside the filter.

If any check fails, the command prints nothing to standard output, writes audit verification failed (<kind>) to standard error and exits with code 1. The kind is signature, manifest, chain, proof or format. An unreadable file or a missing flag exits with code 2.

See the audit export API for how to create and download an export.