Compliance & Logging

Radar action items for audit logging, log sync, and regulatory compliance. Each item below describes the problem, why it is a risk, a concrete example of what can go wrong, and the step-by-step fix in Willow.

Log Sync Missing

Problem. Audit logs only live inside Willow. There is no transport configured to ship them to your SIEM, log warehouse, or webhook.

Why it is a risk.

• Security teams cannot correlate Willow events with the rest of your environment.
• Independent retention is missing, so logs can be lost or modified without an external copy.
• Many compliance regimes require centralized logging with separate access control.

Example. A customer asks for an attestation that admin actions are forwarded to your SIEM. You cannot answer yes because Willow logs only exist in the application's own database.

How to solve it.

1. Open Admin > Settings > Logs and find the Log Providers section.
2. Click Add Provider and configure your destination: Splunk, Grafana Loki, Coralogix, CrowdStrike, or Webhook.
3. Confirm deliveries are landing by checking the Log Delivery page.
4. Configure your SIEM with alerts on high-risk events (admin login, token creation, integration creation, guard breach).
5. Document the destination, authentication, and on-call owner.

Admin Action Logging Disabled

Problem. Admin configuration changes are not being recorded.

Why it is a risk.

• Without admin logs, you cannot tell who turned off a guard, created a token, or changed a security policy.
• Incident response is harder because the actions taken to mitigate or cause an incident are invisible.
• SOC 2 and ISO controls usually require logging of administrative actions.

Example. A guard is suddenly disabled. There is no record of who disabled it or when, so you cannot tell whether it was a legitimate operator or an attacker.

How to solve it.

1. Open Admin > Settings > Logs.
2. Enable Log Admin Actions.
3. Optionally configure a transport so admin events flow to your SIEM as well.
4. Review the Admin Audit Logs page and confirm new admin actions appear.

Audit Retention Missing

Problem. Audit logs have no retention policy, so they are kept forever or pruned arbitrarily.

Why it is a risk.

• Storing logs forever can violate data retention or privacy policies.
• Pruning them too quickly can break investigations that need historical context.
• Auditors will ask for the retention policy in writing.

Example. Your data protection policy says PII-adjacent logs must be deleted after 365 days. Without a retention policy in Willow, those logs are still around three years later, putting you out of compliance.

How to solve it.

1. Open Admin > Settings > Logs.
2. Set Audit Log Retention to the number of days that matches your governance requirements (commonly 30, 90, 180, or 365 days).
3. Confirm the value is reflected in Monitor > Logs by checking the oldest available record after the next pruning run.
4. Update your security documentation with the new retention period.

Device Scanning Missing

Problem. No devices have ever reported scan results, so Willow has no visibility into local AI tools, MCP servers, or skills.

Why it is a risk.

• Shadow MCPs and shadow skills cannot be detected if no agent is reporting them.
• You cannot enforce device-level policies for users that work outside the managed gateway.
• Onboarding gaps are invisible, new hires may install local tools without anyone seeing them.

Example. Several developers are running local MCP servers with broad filesystem access. Without the Scan Agent, you do not know about them and have no inventory.

How to solve it.

1. Open Security > AI Discovery and click the Deploy Scan Agent instructions.
2. Distribute the agent to a pilot group (5–10 users).
3. Confirm devices appear in the device list and capabilities show up.
4. Roll out to the rest of the organization through MDM, Intune, Jamf, or a similar tool.
5. Re-evaluate the Shadow AI and policy items once data is flowing.