SafeDep Documentation

SafeDep Cloud keeps three records of each change to the cloud policy: an audit event for each admin action, a policy revision for each publish, and an email to the Owners and Admins for each risky publish. Use them to review changes and to answer an auditor.

This guide needs the SafeDep Cloud Team or Enterprise plan. See pricing. Reading audit events needs the Admin role.

List the audit events

safedep audit event list --since 7d --action policy.

Each event names the actor, the action, the resource, the result, the time and details such as the revision. Each admin action writes one event, in the same transaction as the action. So an action that failed and rolled back writes no event. These are the actions of the cloud policy:

Action	Resource kind	When
`policy.change.create`, `policy.change.update`, `policy.change.sync`, `policy.change.delete`	`policy_change`	An Admin works on a draft
`policy.change.publish`	`policy_change`	An Admin publishes a change. The details hold the revision and the change direction.
`policy.rule.create`, `policy.rule.update`, `policy.rule.delete`	`package_rule`	An Admin creates, changes or deletes one package rule
`policy.rule.bulk_create`	`policy_change`	An Admin creates block entries from a file. One event covers all of them.
`policy.endpoint_label.set`, `policy.endpoint_label.delete`	`endpoint`	An Admin sets or deletes `custom/` labels on an endpoint
`policy.project_label.set`, `policy.project_label.delete`	`project`	An Admin sets or deletes `custom/` labels on a project

Filter the list:

# Only the package rule actions
safedep audit event list --action policy.rule.

# The events of one policy change
safedep audit event list --resource policy_change/18

# The events of one person
safedep audit event list --actor alice

--actor matches the actor id or the display name exactly.

Review the revisions

Each publish makes one policy revision. A user with the ReadOnly role or a higher role can read them:

safedep policy revision list
safedep policy revision show 47

A revision shows who published it, when, from which change, its change direction, and the policy settings document at that revision. To see the package rules that were active at a revision:

safedep policy rule list --at-revision 47

The revisions show which policy SafeDep Cloud served on a date. The applied revision that an endpoint reports is a record of what the endpoint said. It is not proof, because until endpoint enrollment ships, a holder of the tenant API key can report for any endpoint.

Email notices

Every Owner and Admin of the tenant gets an email after some publishes, such as a publish that loosens the policy. To get the emails, give the person the Owner or Admin role in the tenant. To check a publish that an email names, run safedep policy revision show with the revision of the email. For which publishes send an email and what it holds, see Notices.

Retention

SafeDep Cloud keeps audit events for at least one year, and policy revisions and package rules for the life of the tenant. See Cloud Policy Limits.

Next steps

Policy Revisions and Changes

Change direction and notices.

Roll Back a Change

Undo a publish with a new revision.

Command Reference

Every flag of safedep audit event list.

MDM

Audit Changes to the Cloud Policy

List the audit events

Review the revisions

Email notices

Retention

Next steps

Policy Revisions and Changes

Roll Back a Change

Command Reference

​List the audit events

​Review the revisions

​Email notices

​Retention

​Next steps

Policy Revisions and Changes

Roll Back a Change

Command Reference

List the audit events

Review the revisions

Email notices

Retention

Next steps