Audit Trail, Logging & SIEM Integration

Agility records content-level activity through version history and a Recent Changes report, which capture who changed a content item or page, what changed, and when — giving editors and administrators a reviewable trail of content modifications and the ability to revert to any prior version. Versions are immutable and retained indefinitely. At the platform level, Agility operates on Microsoft Azure with operational audit logging and environment separation. Agility does not offer a native, packaged SIEM connector; to forward content-change events into a customer's logger (Azure Monitor, Splunk, etc.), the implementation partner builds a small webhook handler that pushes each event into the customer's pipeline. In most deployments the observability that matters most — monitoring the live site/app, including its calls to Agility's content APIs — is provided natively by the customer's front-end hosting platform, which is the primary place that telemetry is captured.

What is captured today

• Content & page version history. Every change creates a version; the history shows the modification, the user who made it, the timestamp, and the workflow state of that version. Administrators/editors can view and restore prior versions. Versions are immutable and retained indefinitely, so the full change history of an item is always available and cannot be altered after the fact.
• Recent Changes report. A built-in Recent Changes report surfaces content that has been changed and by whom, giving administrators a cross-item view of recent activity rather than having to open each item's history individually.
• Workflow state transitions. Content moves through staging/approval/publish states, and these states are visible per version.
• Sign-in events. With Enterprise SSO, every sign-in passes through your identity provider and is recorded in its logs (for example, Entra sign-in logs), under your own retention. Agility also keeps authentication logs for its own security operations, and can provide records for a specific investigation on request through support@agilitycms.com.
• Platform operational logs. Azure-level operational logging and monitoring underpin the service (used by Agility operations).

Scope note. Agility's reviewable activity records center on content — version history (immutable, retained indefinitely) and the Recent Changes report. A dedicated customer-facing administrative/security event log (users added or removed, permission/role changes, Personal Access Token creation) is not available today. An administrative audit log is in development, and streaming audit events to a SIEM is on our roadmap: vote for it to tell us you need it. Until then, capture authentication events in your identity provider (e.g. Microsoft Entra) and application/security events at the front-end hosting layer.

Export to SIEM (Azure Monitor, Splunk, etc.)

Agility does not provide a native, turnkey SIEM connector today. It's on our roadmap, and you can vote for it. To push Agility events into a customer's logger/SIEM, the implementation partner builds a small webhook handler: Agility fires a webhook on an event, the handler receives it and forwards it into the customer's logging pipeline (Azure Event Hubs / Monitor / Sentinel, Splunk HEC, etc.). This is a straightforward integration, but it is partner-built, not out-of-the-box — be explicit about that with a security reviewer rather than implying a packaged connector exists.

Webhook events available cover the key auditable actions:

• Changes to content and pages
• Workflow actions
• Publish, unpublish, and delete operations

Turn on secure delivery for the webhook so that your handler can verify each event's signature before forwarding it. This proves the event came from your Agility instance and wasn't altered. Verify the signature rather than filtering by source IP address: Agility doesn't publish a list of webhook source addresses, and they can change. See Verifying Signed Webhooks.

Agility event (content published, item changed, workflow transition, etc.)
        │  (webhook)
        ▼
Custom handler (partner-built)  ──►  Azure Event Hub / Function / Splunk HEC
        │
        ▼
SIEM (Azure Monitor / Sentinel / Splunk) — correlation, alerting, retention

The bigger picture: most observability lives at the front-end/hosting layer

In practice, what enterprises most often want to monitor is the running website or application, and that telemetry already exists at the hosting layer. Modern hosting platforms (Vercel, Netlify, Azure, etc.) almost always include logging, metrics, and observability out of the box — including request traces and outbound API-call dependencies, which means they can already capture the application's calls to Agility's content APIs (latency, errors, volume). For most monitoring requirements, this front-end/hosting observability is the primary, native answer, and the webhook-to-SIEM handler above is a complementary path specifically for content-change auditing inside Agility.

Shared responsibilities

Area	Agility	Implementation partner / customer
Content/page version history	✅ Captures who/what/when; supports revert	✅ Reviews history as part of governance
Admin/security event logging	Content activity via version history + Recent Changes; no dedicated customer-facing admin/security event log	✅ Uses IdP + hosting logs for auth/security events
Immutability & retention of records	✅ Versions immutable, retained indefinitely	✅ Maps to its own retention requirements
Content-change event source for SIEM	✅ Provides webhooks (content/page changes, workflow actions, publish/unpublish/delete); no native SIEM connector	✅ Builds the webhook handler + SIEM pipeline (Azure Monitor/Splunk), retention, alerting
Live app/site observability (incl. calls to Agility APIs)	✅ Provides the content APIs being called	✅ Uses front-end hosting observability (Vercel/Netlify/Azure) to trace requests + API dependencies
Forensic/incident requests	✅ Platform-level logs (Agility operations)	✅ Application-level logs for its own front end