Inforcer Audit Events — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Inforcer Audit Events (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Inforcer records an audit trail of activity and changes it observes. This skill covers searching that trail (auditEvents) and enumerating the event-type catalog you filter against. It is a read-only history surface — it tells you what happened and when, which is the evidence layer behind a drift or posture report.
Read api-patterns first for the gateway headers, the region requirement, the {success, message, errors, data} envelope, and continuationToken pagination. Audit searches commonly span many pages — paging to completion matters more here than almost anywhere else, because a partial page silently drops events from the window you think you searched.
inforcer_audit_event_typesList the event-type catalog — the set of event types Inforcer can record. Returns the type identifiers/labels you use to filter a search.
inforcer_audit_event_types()Pull this first when you need to filter auditEvents by type: it tells you the valid type values rather than guessing. The catalog is also a useful map of what kinds of activity Inforcer tracks at all.
inforcer_audit_events_searchSearch the audit event history. Supports filtering — typically by tenant (integer Client Tenant ID), event type, and a time window — and returns the matching events.
inforcer_audit_events_search(
clientTenantId=1423,
eventType="<from the event-type catalog>",
from="2024-02-01",
to="2024-02-29"
)Returns event objects describing what occurred, when, and (where the API exposes it) the actor and target. This is the primary input for "what changed on this tenant in the last month?" questions.
| Pattern | Why it matters |
|---|---|
| Change events that line up with a drift finding | Connects "the tenant drifted" to "here is the change that caused it" |
| Privileged-role or policy changes | Highest blast radius; worth corroborating against identity review |
| A burst of activity around an incident window | Helps reconstruct a timeline for post-incident review |
| No events where you expected some | May indicate a filter mismatch (wrong type or window) rather than genuine quiet |
types = inforcer_audit_event_types() # discover valid types
ctid = resolve("Acme") # integer Client Tenant ID
events = inforcer_audit_events_search(
clientTenantId=ctid,
eventType=types[...], # a value from the catalog
from="2024-02-01", to="2024-02-29")Discover the event types first so your filter uses real values; an invalid type quietly returns nothing and looks like "no activity." Page continuationToken to completion before concluding the window is empty.
When baseline-alignment shows a tenant has drifted, search auditEvents for the same tenant around the drift window to find the change(s) that produced it. Audit gives the narrative behind the alignment delta — useful in a report and in client conversations.
but you cannot create, edit, or delete audit events, and audit events are history — they don't let you undo or remediate anything.
auditEvents shape, the event-type catalog values, and the exact filter parameter names are illustrative and credited to royklo/InforcerCommunity. Confirm filter field names against the catalog on first use.
empty result is more often a wrong filter (unresolved tenant id, invalid event type, or a too-narrow window) than genuine silence — widen and re-check before reporting "no activity."
under-report a change window.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.