Greymatter.ioGreymatter.io
Start for Free
Greymatter.ioGreymatter.io Why Greymatter.io?
Pricing Start for Free
Product • Forensic Auditing

Built for the moment someone says, “Prove it.”

Ordinary logs guess. Greymatter.io answers.

Production Platform 88 svc · 12 ns Search identities, request ids, namespaces ▲ 10 degraded● 743 healthy
230K
AUDIT EVENTS · 24H
0
WAF BLOCKED
0
POLICY DENIED
5
IDENTITIES SEEN
AUDIT EVENTS BY NAMESPACE · SCOPE
orders166K
payments35K
records17K
billing4,591
reports1,306
HOW IDENTITY ARRIVEDrequests at the first audited hop
Service to service a SPIFFE source185,958 · 81%
Passed on by an earlier hop x-user-id35,873 · 16%
No identity refused at the hop7,723 · 3%
Product view · sample data. Names and identifiers are obscured.
Verified, not claimed
A record of every step
Who it was for, and how they signed in.
Open the case file →
FIPS 140-3 validated
(CMVP #5191)
Validated by NIST.
See Security Standards →
GigaOm Radar Leader and Outperformer, 4+ years
Named a Leader and Outperformer in service mesh.
Read the Report →
Questions you cannot dodge

The audit questions land the day something goes wrong.

An incident does not wait for business hours. Someone above you wants specific answers, not a folder of logs to sort by hand.

Tap a card to see how Greymatter.io solves it.
Who touched this resource, and when?
Tap to reveal →
Every signed-in person is named at login, through OIDC or PKI, and stays attached to every transaction that follows. Search by name, not by exporting logs.
Greymatter.io solves it
Did an AI agent act on its own, or for a human?
Tap to reveal →
Both identities land in the same record. The human who delegated the action, and the agent that carried it out, linked by one shared ID if the work crossed multiple services.
Greymatter.io solves it
Was the request blocked, and by which rule?
Tap to reveal →
The rule that fired and the result it produced are linked to the same request, in the same console. One place to look.
Greymatter.io solves it
Can you produce evidence before the auditor asks twice?
Tap to reveal →
Search by person, service, or request ID, and the full record comes back from one search. No exporting logs, no stitching files together.
Greymatter.io solves it
Judge the evidence yourself

A pile of logs is not an audit trail.

Logging traffic tells you a request happened somewhere in the stack. A forensic record tells you who acted, what they did, and what happened as a result.

Interactive · Try it
Ordinary logs Greymatter.io forensic record
Incomplete trail
10.2.4.19 - - [14/Sep/2026:09:41:22] "POST /v2/orders/refund HTTP/1.1" 200 842
connection reset by peer, retrying upstream
10.2.4.31 - - [14/Sep/2026:09:41:24] "GET /health" 200 12
auth token present, no identity resolved
10.2.4.19 - - [14/Sep/2026:09:41:29] "POST /v2/orders/refund HTTP/1.1" 200 842

What it is missing: no named human, no named agent, no reason attached. Answering “who did this” means stitching three other systems together first.

Open the case file

Every audit field, named. Nothing left to interpretation.

One transaction writes one structured event. Select a field to see what it captures and why an investigator needs it.

Human identity is established through OIDC or PKI at login and attached to every transaction that follows. The name in this field is a person, not a token. If that person is acting under an impersonated identity, the record keeps that too.

When an AI agent or automated process acts for a human, the agent’s identity is recorded alongside the human’s. Neither identity replaces the other in the record.

The exact endpoint and method involved in the transaction, named plainly enough that an investigator does not need to decode it.

What happened as a result of the request, allowed, denied, or errored, written into the same event instead of a separate status log.

The precise moment the transaction crossed the platform, giving investigators a sequence they can trust without cross-referencing clocks across systems.

A single request can touch several systems before it is finished. Greymatter.io ties every step together with one shared ID. The investigator reads one story, not three logs to reconcile by hand.

Production Platform 88 svc · 12 ns Search 757 objects across 8 types ▲ 10 degraded● 743 healthy
Forensic audit · identitiesACTOR
HOW IDENTITY ARRIVEDat the first audited hop
OIDC from2,210 · 12%
PKI certificate ssl-client-s-dn0 · 0%
Service to service a SPIFFE source185,958 · 69%
Passed on by an earlier hop x-user-id35,873 · 16%
No identity no header7,723 · 3%
01 forensic_event.json
Actor

Human identity is established through OIDC or PKI at login and attached to every transaction that follows. The name in this field is a person, not a token. If that person is acting under an impersonated identity, the record keeps that too.

{
event_id: evt-8b2f1a
actor
j.okonkwo (OIDC)
on_behalf_of
batch-runner (allow-listed)
02 forensic_event.json
On behalf of

When an AI agent or automated process acts for a human, the agent’s identity is recorded alongside the human’s. Neither identity replaces the other in the record.

actor
j.okonkwo (OIDC)
on_behalf_of
batch-runner (allow-listed)
action
POST /v2/orders/refund
03 forensic_event.json
Action

The exact endpoint and method involved in the transaction, named plainly enough that an investigator does not need to decode it.

on_behalf_of
batch-runner (allow-listed)
action
POST /v2/orders/refund
result
200 OK
04 forensic_event.json
Result

What happened as a result of the request, allowed, denied, or errored, written into the same event instead of a separate status log.

action
POST /v2/orders/refund
result
200 OK
timestamp
2026-09-14T09:41:22Z
05 forensic_event.json
Timestamp

The precise moment the transaction crossed the platform, giving investigators a sequence they can trust without cross-referencing clocks across systems.

result
200 OK
timestamp
2026-09-14T09:41:22Z
event_chain
evt-8b2f1a → evt-c93d07 → evt-1a44e2
06 forensic_event.json
Event chain

A single request can touch several systems before it is finished. Greymatter.io ties every step together with one shared ID. The investigator reads one story, not three logs to reconcile by hand.

timestamp
2026-09-14T09:41:22Z
event_chain
evt-8b2f1a → evt-c93d07 → evt-1a44e2
}
signed · sha256 verified
1 / 6 · Swipe for next field
62%

Faster audits for one customer.

Evidence generated by normal operation instead of gathered in a scramble the week before an audit. The record exists before anyone asks for it.

Plays well with what you run

Every request leaves a record.

Read it in the console, or pull it into your own systems.

Built into the platform, not bolted on. One installation, one dataset, nothing separate to license or maintain.

Splunk
Elasticsearch
Kibana
Grafana
Prometheus

Have the answer before anyone asks.

Every month without a forensic record is another audit finding with your name on it.

Start for Free Meet Our Security Experts Browse How to Buy →
Keep digging

Go deeper on the platform behind the forensic record.

Product Identity Verify users, workloads, and AI agents. Learn more → Use case AI & Agent Control Decide which tools AI agents can use. Learn more → Use case Accelerated ATO Reach federal authorization faster. Learn more →
Swipe for more
Answered before you ask

Straight answers about forensic auditing, no scrolling through a manual.

Greymatter.io writes one structured event for every transaction that crosses the platform. The record names who acted, what they did, and what happened.

Logs say something happened. A Greymatter.io forensic event names the actor, the action, and the result in one record.

No. Passwords, keys, and tokens never appear in Greymatter.io logs or records. Tokens are saved as a fingerprint, so a stolen token used twice stands out.

In our sizing tests, a default proxy held 1,200 requests a second at p99 under 10 ms, with every request audited. The audit log store scales with request volume.

The Forensic Audit page covers the last 24 hours, 7 days, or 30 days. Changes made by people stay in the change log for 395 days.