Skip to main content
Both pages sit under Govern. Compliance maps what the fleet did to named framework controls. Audit Trail is the record: every captured agent action, and every action a person took in the console.

​
Compliance

The page states what it is: “Your fleet’s framework coverage, from the served policy pack and the window’s detections.” And what it is not: “Nothing on this page is a percentage of a framework or a compliance opinion. Quint’s own certification status is stated on quintai.dev, not here.” Served pack facts come first: Served pack, Lease, Declared mode, Tenant enforcement, Enabled families. These describe the ruleset your machines hold now; see How policies work. Controls named by the served pack lists the controls the pack’s rules map to. Detected activity by framework control counts detector fires per control for the window, default Last 7 days. Its legend: S means “control text literally describes what fired”; P means “a reasonable analyst would accept the mapping”. The window hint says “Kept 14 days”: the page looks back 14 days at most. Technique census appears only when the window has MITRE technique fires; it is “MITRE catalogues · a census of detector fires, not a compliance card”. The frameworks the page maps to: CSA Cloud Controls Matrix; EU AI Act; ISO/IEC 42001; MITRE ATLAS; MITRE ATT&CK; NCA CCC, NCA DCC and NCA ECC; NIST AI RMF; NIST SP 800-53; OWASP Top 10 for Agentic Applications; OWASP Top 10 for LLM Applications; SAMA CSF; SOC 2 Trust Services Criteria. Export CSV downloads the table for the window. Empty states: “No detector fires mapped to a control framework in this window.” and, when no ruleset is published yet, a note that every framework shows 0 named controls until one is.

​
Audit Trail

Two tabs. Event search is “captured agent activity · newest first”. Console actions is the “administrative audit log · newest first”. Tiles: Matching server-side, Fetched this page, Matching on screen and Distinct sessions. Controls: the range (default Last 24 hours), All action types, verdict Any verdict, Flagged or Blocked, the on-page filter “Filter this page — action, tool, MCP server, session, model…”, Refresh, and ← Newer / Older →. Top actions ranks the window. The columns, in plain words: when the action happened; what kind of action it was; the tool the agent called; what it was aimed at; the decision recorded on it; its risk score; the session it belongs to; the event’s own identifier. The empty state: “Empty is not the same as clean — it means nothing arrived in this window. Check a wider range, and check the fleet’s capture state before concluding the endpoints were quiet.”

​
Console actions

The tab describes itself: “This log records logins, policy and credential changes, role changes and incident triage.” Filters: All actions, All actors, Partner actions. Reading it needs Admin or Owner: “Reading the administrative log requires the admin role.”

​
Audit-chain integrity

The panel reads “last 7 days · verified on request” and checks the log’s chain when you ask. Verdicts: intact, broken, partially checked, indeterminate, not checked. It reports rows walked, chains covered and rows not verifiable. Treat anything other than intact as a result to read, not a pass.

​
Export

Export and Export CSV download what you are looking at. Of the administrative log, Settings › Audit says: “Export downloads the whole log as a file and is itself recorded.”

​
Evidence for an auditor

Three things you can hand over:
  1. Compliance CSV: Export CSV on Compliance. The controls the served pack names and detector fires per control, for a window of up to 14 days. Export before the window moves.
  2. Audit Trail export: Export on Audit Trail, for captured agent activity or for console actions. The Audit page download is what you see on screen; Settings › Audit export is the recorded export.
  3. Streamed audit log: under Settings › Audit › Streaming. “Every enabled batch exporter receives the admin audit log as a second stream beside telemetry; the realtime alert channels do not.” Until you set one up it reads “No batch exporter is configured, so the audit log is not streamed anywhere yet.” See Export to your SIEM.
None of these is a compliance opinion. Quint’s own certification status is stated on quintai.dev, not in the dashboard.

​
Next