Named Users and Devices
Access decisions name the user and the device, not just an IP address.
Access audit trailsSecurity visibility
Show Auditors Who Accessed What, When, and From Which Device
Customer problem
Access Evidence Is Hard to Produce
Auditors and incident responders ask the same questions: who connected, from which device, was it healthy, and was access allowed or denied?
Remote-access logs show an IP address, not a device. Firewall logs show addresses and ports, not users. Endpoint tools miss which application was reached. Each tool has its own format and console.
Pulling these together can take days.
- Network logs that record IPs, not people
- Shared addresses that belong to different devices over a day
- Device health not recorded at connection
- Allowed connections with no policy reason
- Separate formats and consoles to correlate by hand
- Gaps between layers that nobody checked
THE COSGRID SOLUTION
Identity-Based Evidence at Each Layer
COSGrid does not claim to be a single audit system. Each product makes access decisions against verified identity and records them for its own layer. Where a product supports export, that evidence can be sent to your SIEM, where your team correlates it.
With COSGrid, organisations can
- Attribute application access to a named user and device
- Record device admission, denial and quarantine on the LAN
- Log traffic allowed and blocked between network zones
- Export evidence to their SIEM where each product supports it
- Use shared policy objects across products through Guider
How It Works
Establish Identity
Users authenticate through your identity provider. Devices running the COSGrid agent carry a certificate identity.
Check Posture and Decide
Where posture checks are in use, device health is evaluated first. Each product then allows or denies the request against policy.
Record and Export
Each product records its own access, admission or enforcement decisions, and exports them to your SIEM where supported.
Correlate and Report
Investigators and auditors query the records in your SIEM, using the retention and reporting you already run.
Key Benefits
Per-Application Records
Deny-by-default, per-application access means records show exactly which application was reached.
Device Admission Records
ZT-NAC records which devices joined, were denied or were quarantined on the office LAN.
Network Enforcement Logs
NexusShield records allowed and blocked traffic, covering devices that cannot run an agent.
Network Context
NetShield NDR is designed to show what traffic crossed the network after an access event.
Evidence in Your SIEM
Records export to your SIEM where each product supports it.
Fragmented Access Logs vs Identity-Based Evidence
Fragmented Access Logs
- IP addresses in network logs
- Anonymous devices behind shared pools
- Device health not recorded
- Allowed connections with no stated reason
- Separate formats for each tool
- Manual correlation across consoles
Identity-Based Evidence
- Named user and device in access decisions
- Certificate identity per agent-running device
- Posture checked before access
- Allow or deny decided against policy
- Shared policy objects across products (Guider)
- Records exported to your SIEM where supported
Use cases
Built for every audit scenario
Show who accessed a sensitive application
An auditor asks who accessed the finance application last quarter. MicroZAccess records show the users and devices granted access.
Trace an unusual login to a device
A user's account is used at an unusual time. The team checks which device connected, whether it was the user's enrolled device, and what it reached.
Evidence that unknown devices are kept off
An auditor asks how unknown devices are kept off the office network. ZT-NAC admission, denial and quarantine records show the control operating.
Separate records for contractor access
Records show which applications a contractor reached and when, separate from employee access.
Who Is This For
Want the access model behind these records? See "Give employees access to applications, not the whole network"
- Compliance & Internal Audit Teams
- CISOs
- SOC Teams
- IT & Security Architects
- Regulated Sectors
FAQs
Have a question about access audit trails and security visibility?
What is an access audit trail?
It is a record of who accessed which resource, when, from which device, and whether access was allowed or denied. It supports audits and incident investigations.
Does COSGrid store all logs in one place? No. Each COSGrid product records evidence for its own layer. Where a product supports export, its records can be sent to your SIEM, which is where they are combined.
Which SIEM tools are supported? It depends on the product. SecureWebAccess exports to Splunk, Elasticsearch and CEF. SwiftZAccess streams decisions to the customer SIEM.
