kb-audit-query

You can filter audit logs by applying the --since, --until, and --event-type flags to restrict log events to specific timeframes and actions. This read-only process queries index metadata from library/audit.log to isolate relevant confidentiality incidents.

Summarizing knowledge-base audit logs for compliance reporting is done using the --summary flag. It processes filtered audit events to generate concise summaries of confidentiality incidents and policy violations without requiring manual review of raw logs.

Yes, you can investigate confidentiality incidents for specific source handles by applying the --source flag. This filters the knowledge-base audit log events to isolate activities associated with that particular source handle.

No, kb-audit-query operates strictly in read-only mode. It reads only index metadata from library/audit.log to ensure safe log analysis during incident investigations and compliance reviews without modifying project files.

Querying index metadata for audit reviews allows you to safely surface cross-library knowledge-base policy violations. It avoids parsing heavy raw logs directly, enabling efficient filtering and summarization of confidentiality incidents across project libraries.