How to close the SOC 2 audit logging control in Drata
If Drata is showing your audit logging or monitoring control as needing evidence, here's the fastest way to close it: generate an evidence bundle from AuditRails and attach it directly to the control, plus what it takes to automate this with Drata's Custom Connections and Tests if your Drata plan supports it.
What Drata checks for this control
Drata's automated tests continuously evaluate connected data against a control's requirements, surfacing pass or fail status without manual screenshots. For a logging or monitoring control tied to SOC 2 CC7.2, that means proof that system activity is actually being logged and retained, not just that a logging tool is in place. Without a connection streaming that data automatically, the control needs manually attached evidence.
The fastest path: attach an evidence bundle
This works today with no new integration required. AuditRails' evidence bundle is a zip containing a PDF summary, an NDJSON export of the underlying events, and a manifest with SHA-256 hashes, which you can attach directly to a Drata control as evidence.
- 1
Generate a compliance report in AuditRails
From Compliance, Reports in your AuditRails dashboard, generate a SOC 2 report for the date range your auditor is reviewing.
- 2
Download the evidence bundle
Once the report is ready, download its evidence bundle: a zip with the PDF report, an NDJSON event export, and a manifest.json with SHA-256 hashes of each file plus the underlying hash-chain proof.
- 3
Add it as evidence in Drata
In Drata's Evidence Library, or directly on the relevant control, choose Add Evidence and attach the zip or its PDF summary as a file.
- 4
Mark the control satisfied
Once the evidence is attached, mark the control as satisfied. Repeat each audit period, or move to the automated path below if your Drata plan supports it.
If you want it automated
Drata's Custom Connections and Tests (CCT) feature lets a team push structured JSON evidence via Drata's Open API and map it to specific controls, but it's only available on Drata's Advanced and Enterprise plans, and Drata's own documentation is explicit that building one requires engineering effort on the customer's side, it isn't a plug-and-play integration. Since AuditRails exposes the same underlying event data via its API, a team on a qualifying Drata plan can build a CCT against AuditRails' data so the control updates automatically. AuditRails doesn't currently ship this as a pre-built connector; the manual path above works regardless of Drata plan tier.
Frequently asked questions
Why is my audit logging control showing as needing evidence in Drata?
Usually because no connection is streaming your logging data automatically and no evidence has been manually attached yet. Attaching an AuditRails evidence bundle resolves this immediately, regardless of your Drata plan.
Does AuditRails have an official Drata integration?
Not a pre-built one today. The manual evidence-bundle upload works on any Drata plan; Custom Connections and Tests (CCT) built against AuditRails' API is possible for teams on Drata's Advanced or Enterprise plan who want the control to update automatically.
What's actually in the AuditRails evidence bundle?
A PDF summary report, an NDJSON export of the underlying log events for the date range, and a manifest.json containing SHA-256 hashes of each file plus the hash-chain proof for that period, so the bundle's own integrity is checkable independently of AuditRails.
Do I need Drata's Advanced or Enterprise plan to use this?
No, only if you want to automate it via Custom Connections and Tests. The manual evidence-bundle upload works on any Drata plan and is the faster path to close the control today.