policydb-activity-review

Audit log session clustering groups raw audit log changes into distinct user work sessions using configurable session gaps. This mechanism isolates specific user activity windows for accurate accountability and thorough audit reviews.

Yes, you can configure session gaps and gating logic within the anomaly_engine. This allows you to customize how the audit log is clustered into sessions and how recent activity gates are checked during the activity review process.

The best way to prepare for an unlogged activity review is to ensure the audit_log contains complete records of user and system changes. The Skill processes these raw audit entries end-to-end to identify suspicious sessions and write suggested_activities.

Your recent activity gate may fail because unlogged user activity was not captured in the standard logs. By scanning the audit_log and clustering changes, the Skill identifies missing sessions and writes them to suggested_activities to resolve gate check failures.