Security audit trail and SIEM export
Last updated: August 31, 2026
Overview
Canvas can keep a security audit trail of sign-ins, chart access, and clinical data changes, and can optionally stream those events to your security information and event management system (SIEM).
The audit trail is recorded using the Open Cybersecurity Schema Framework (OCSF). Events use opaque identifiers and do not include patient or provider names, dates of birth, or clinical values.
How you can access the audit trail
Canvas supports two ways to review security audit events:
Audit trail view in Canvas: a retained, read-only view for customers who do not run a SIEM.
SIEM export: an optional export that posts events to an HTTPS endpoint you nominate, such as a Splunk HEC, Datadog intake, or generic webhook.
Availability
The security audit trail is off unless it has been enabled for your Canvas instance. Reach out to Canvas Support to enable it and configure your audit trail or SIEM export settings.
Audit trail access in Canvas
The customer-facing audit view is read-only. Access is controlled deliberately and requires both:
The audit view to be enabled for your instance.
The appropriate audit-view permission to be granted to the user or group that should see it.
No existing customer role receives audit-view access automatically. This keeps audit data locked down by default.
SIEM export behavior
When SIEM export is enabled, Canvas sends audit events as batched newline-delimited JSON (NDJSON) over HTTPS. Export dispatch runs approximately every 2 minutes.
A delivery is considered successful when the configured endpoint returns a successful HTTP response. If your endpoint accepts a batch and then drops or rejects records downstream, Canvas may not be able to detect that from the dispatcher side. For that reason, customers should monitor their SIEM or intermediary pipeline for dropped-event counts and reconcile received events as needed.
PHI and identifiers
Canvas supports two identifier modes for SIEM export:
Direct: sends Canvas patient and resource identifiers.
Pseudonymized: sends a keyed hash of those identifiers, supporting event correlation without sending reversible identifiers to the SIEM.
Pseudonymization is not the same as Safe Harbor de-identification.
Retention and archive behavior
Audit events remain queryable in Canvas for the configured retention period, which defaults to 90 days. After that period, events move to secure S3 archive storage and are pruned from the retained Canvas view.
When SIEM export is enabled, Canvas only archives events that have been shipped or marked as unable to ship; unshipped backlog events are not archived before delivery handling completes.
Configurable settings
Canvas Support can configure the following settings for your instance:
Setting | Description |
|---|---|
| Records the audit trail once the capability is enabled for your instance. Turning it off stops recording entirely. |
| How long events stay queryable in Canvas before older events are archived. Defaults to 90 days. |
| Sends recorded events to your SIEM endpoint. |
| The HTTPS endpoint where Canvas posts events. |
| The authentication header name Canvas should use when posting events. |
| The authentication header value Canvas should use when posting events. |
| Controls whether Canvas sends direct identifiers or pseudonymized identifiers. |
| Maximum events per request. Defaults to 500. |
| How many times an endpoint-rejected payload is retried before it is set aside. Defaults to 5. |
Retry behavior
Canvas retries temporary delivery failures, such as network errors, many server-side failures, and rate limits. Payloads rejected by the endpoint, such as malformed or oversized batches, are retried up to the configured maximum attempts before being set aside.
If an endpoint is unreachable, Canvas continues retrying and does not treat the payload as permanently rejected solely because the endpoint is unavailable.