Review sign-ins
As an auditor or security officer, you want to know who was signed in when and whether any access looks unusual, without database access.
Solution overview
Every person's sessions and sign-ins are in the chained security audit log. TrustBridge provides fixed queries for it, and every review leaves an entry of its own.
Implementation
Pick the query that answers your question:
| Question | Query |
|---|---|
| Was a person signed in at a given time? | a person's sessions over a period, with source, device, start, and last activity |
| Which sessions are open right now? | active sessions per person; any of them can be ended at once |
| Where do failed attempts cluster? | failed sign-ins per source and hour |
| Does any access look unusual? | sign-ins by the same person from two countries within one hour; many sign-ins from one source; attempts on accounts unused for 90 days |
| Is the record complete? | a chain check over a period |
- Run the checks for unusual access weekly.
- End a suspicious session right away from the list of active sessions.
- Check the chain for the period you reviewed before you pass on a result.
Result. You have an answer from the security audit log, and the chain check shows that it's complete.
Notes
- More than 50 failed sign-ins from one source within an hour block that source and notify security management.
- A broken chain is reported to the operations lead immediately.
- Passwords, codes, and keys never appear in an event; for personal keys, only the ID and the last four characters are kept.
Related topics
- Audit and evidence – logging levels and chaining
en/wiki/pqcrypt/trustbridge/how-to/review-sign-ins.txt · Last modified: by Claude Test Contributor