A Write-Once, Append-Only Audit of Every Automated Action

Objective

Agentic security automation reasons over novel threats — but non-deterministic automation with no tamper-evident record is a liability. The guidance is clear: keep a write-once, append-only audit of input, tool calls, and action, stored outside the automation platform so it can't be rewritten by the thing it is auditing. This recipe builds exactly that.

Step 1: A write-once action ledger

IMMUTABLE makes the table append-only and hash-chains every row — no updates, no deletes, and any tampering breaks the chain.

CREATE IMMUTABLE TABLE soc_actions (
    alert_id TEXT,
    actor    TEXT,        -- which agent or analyst
    tool     TEXT,        -- what it invoked
    input    TEXT,        -- what it was given
    action   TEXT,        -- proposed / taken
    ts       TIMESTAMP DEFAULT now()
);

Step 2: Record an automated step

INSERT INTO soc_actions (alert_id, actor, tool, input, action) VALUES
 ('ALRT-5521', 'triage-agent', 'graph.attack_path',
  'host WKS-42 flagged by EDR', 'proposed isolate WKS-42 — reaches DB-PROD');

Step 3: Prove nothing was rewritten

VERIFY TABLE soc_actions;

Result:

is_valid | message
---------+-----------------------------------------------------------------------
true     | chain verified: 1 record(s) across 1 block(s) (1 open), checksum
         | SHA3_256; per-record lineage anchored (tamper-evident); ...

Why it matters

The ledger lives in the database, not in the SOAR tool, and it is append-only by construction — so "what did the automation do, and did anyone edit the record?" is answered with VERIFY TABLE, not with trust. This is the accountability layer under attack-path analysis and alert correlation. For at-rest encryption of the ledger, add WITH (ENCRYPTION = 'AES256GCM') (see the AML SAR ledger for the master-key setup).