KPATH

How do you verify a KPATH audit log without trusting KPATH?

You export the record to write-once storage you control and run KPATH's standalone verifier against it. The record is signed and tamper-evident, so the verifier reports whether anything was altered, removed or inserted since it was written. It runs offline, and KPATH's console is not involved.

A log you control is not evidence.

A log you control is not evidence. A log the vendor controls is not evidence either. Evidence is a record that a third party can check without having to trust whoever produced it.

What you get

Every governed call produces a record: which agent acted, on whose authority, what was decided, and the outcome. Never a secret or a message body.

That record is signed and tamper-evident. Anything altered, removed or inserted after the fact shows up as a failed check, and the check is one you run yourself rather than one KPATH runs for you.

The record is streamed to your SIEM as it happens and exported for retention. Once it is on write-once storage you control, neither you nor KPATH can quietly change it.

What you can prove

KPATH provides a verifier and a sample export, on request or as part of a pilot. The verifier runs locally and reports whether a record is intact. The sample export covers a known scenario, including a chain stop, so you can see what a valid record and a tampered one each look like before you run the check on your own data.

Steps

  1. Get the sample export

    Ask us for the sample audit record. It is small and self-contained, so you can try the check before you point it at anything of your own.

  2. Get the verifier

    Get the verifier alongside it. It runs on your own machine and needs no connection to KPATH, which is also what makes the check work in an air-gapped environment.

  3. Run it against the sample

    Run the verifier over the sample export and read what an intact record looks like, then over the tampered sample and read what a failed check looks like.

  4. Export your own record and run it again

    Take an export from your own write-once storage and run the same verifier over it. Nothing about the check changes, and no part of it goes through KPATH.

  5. Read the result

    An intact result means nothing has been altered, removed or inserted since the record was written. A failed result names where the check broke. Either answer was reached without KPATH’s console and without trusting KPATH.

What this gives an auditor

The auditor can answer, from the record alone, which agent did what, on whose authority, and whether the decision was allow, refuse or wait for approval. After a chain stop, the same record shows that nothing in the chain was authorised after the stop, which is the containment proof described on whole-chain containment.

The auditor does not need to trust KPATH’s console, KPATH’s operators or KPATH’s account of events. That is the difference between a log and evidence, and it is the Prove step of the Verify-Enforce-Stop-Prove test.

FAQ

Common questions

What does the verifier prove?

That the export is the record KPATH wrote and that nothing in it has been altered, removed or inserted since. If anything was changed, the verifier reports where the check failed.

Does verification need access to KPATH?

No. The verifier runs offline against an export you hold. KPATH's console is not used, so the check does not depend on trusting KPATH.

Where should the export live?

On write-once storage you control, so the record cannot be changed after it lands. The record is streamed to your SIEM as it happens and exported for retention.

What is in the record?

Who acted, on whose authority, what was decided and the outcome, for every call. Never a secret or a message body.

Published Updated

The first step

Start in monitor mode. See everything before you enforce anything.

Deploy in monitor mode: observe only, enforce no policy, rewrite no agents. Flip to enforce by repointing egress. See the agents already running in your estate before you decide what to enforce.

Book a monitor-mode pilot See the platform