Start with onboarding
Decisions retain context
Review the evidence and closure reason together on the closed case.
MSSP/MDR · Process
Hand each customer's auditors the records they ask for.
Case records, reports and audit exports.
Bring case records and framework-specific reports into the customer review, alongside audit exports with the actor and before-and-after values. Your team can explain recorded decisions from the investigation and supply records for review, with framework mappings kept distinct from any claim of certification.
Case evidence and closure reasonAudit export as CSV or JSONMapped to 37 security and compliance frameworks
Northstar: records for reviewNorthstar
NS-104
- Case
- NS-104
- Status
- Closed
- Disposition
- Recorded
- Closure reason
- Reviewed activity resolved
- Owner
A. Rivera
Closed
Evidence
Sign-in logsEvidence attached to NS-104
Investigation timelineRecorded actions on the case
Analyst notesDecision context
Closure reason
Reviewed activity resolved.
Templates
ComplianceOrganize evidence for a review
- Customer
- Northstar
- Scope
- Active tenant data
- Format
Review
Assess the records against the customer request.
Compliance
Case outcomesRecorded disposition and closure reason
Activity recordsActor and action context
Evidence referencesSupporting investigation records
Framework mappings
Mapped to 37 security and compliance frameworks.
Audit Log
- Tenant
- Northstar
- Period
- Q3
- Export
- CSV or JSON
Recorded values
Actor, timestamp and action type, with before-and-after values.
Export CSVExport JSON
EventsA. Rivera / 09:10Case updated: Investigation to Containment
M. Kaya / 10:25Case updated: Containment to RecoveryA. Rivera / 11:00Case updated: Recovery to Closed
A. Rivera / 09:10Case updated: Investigation to ContainmentM. Kaya / 10:25Case updated: Containment to RecoveryA. Rivera / 11:00Case updated: Recovery to ClosedScope
Review the selected period and customer before exporting.
History
ComplianceNorthstar / PDF
GeneratedIncident ResponseNorthstar / PDF
Generated- Customer
- Northstar
- Scope
- Active tenant data
- Template
- Compliance
Review pack
NS-104 case recordEvidence and closure reason
Northstar report.pdfGenerated report
Northstar audit.csvAudit export
For review
Illustrative grouping of separately selected records.
A report or audit export supplies records for your review. Framework mappings are not certifications.
Review the closed case with its evidence, timeline, disposition and closure reason.
Use the Compliance template to organize records for review. The sections shown are illustrative.
Review actor, timestamp and before-and-after values for the selected customer scope, then export CSV or JSON.
Bring the case record, generated report and audit export together for review.
Illustrative customer workflow
01 - What it does
Answer the audit request from recorded work.
Use the investigation record to explain what happened and the audit log to review recorded actions. Framework-specific reports organize evidence for the review; the reviewer still needs to assess what those records demonstrate.
Keep the decision and its context together.
A closed case can retain the evidence and timeline your team used, with its disposition and closure reason. Reports organize records into a review format, while an audit export adds the actor and before-and-after values for recorded actions. Select the customer scope and review the output against the request before handing it over, so the customer receives relevant records with the context to assess them. Keep the closure reason with the evidence it explains when reviewing the case with your team.
An audit request becomes an export, not a reconstruction.
Northstar: review packExample
- Case
- NS-104
- Report
- Compliance
- Audit export
- CSV or JSON
- Review
- Customer scope checked
Illustrative customer and values. Not customer performance data.
Records in a usable format
Export the audit log as CSV or JSON for the review.
02 - How it works in the product
Check the scope before sharing the records.
Start with the customer request and identify the records that answer it. Review the case, generate the relevant report and export the matching audit events, then check the pack before sharing.
- 01Casebook
Review the closed case evidence, timeline, disposition and closure reason.
- 02Reports
Choose a framework-specific template to organize evidence for the compliance review.
- 03Audit Log
Review Events for the permitted customer scope and selected period, then export CSV or JSON.
- 04Reports
Check the generated report in History alongside the records you have selected.
Imperum is mapped to 37 security and compliance frameworks. These are mappings in the product, not certifications Imperum holds. A report or audit export supplies records for your review.
03 - How it connects
Connect the decision to the supporting records.
Casebook preserves the investigation context. Core Reports organizes records for review, and the Audit Log records actions with their actors and values. Use those sources together when preparing the customer pack.
Works with
In the editions
The Portal, Autonomous SOC and SecOps PlatformIncluded
Casebook and Reports belong to the core workspace. Audit access follows permissions.
04 - What it means for your service
Answer audits from records you already keep.
Prepare the customer review from the records your team works with. Keep the scope visible and the decision attached to its evidence, so the discussion can focus on what the records establish.
Less reconstruction
Start with retained case evidence and its recorded closure reason.
Actions have context
Audit entries carry an actor, timestamp and before-and-after values.
A clearer customer handoff
Review the report and audit export against the customer request before sharing.
Start with one customer
- 01Define the request
Agree which customer period and decisions the review covers.
- 02Collect the matching records
Review the case, generate the report and export relevant audit events.
- 03Check the pack
Confirm scope and context, then identify any evidence the reviewer still needs.
Questions about Compliance frameworks.
1What can we hand an auditor?
Framework-specific report templates organize evidence for a compliance review. Audit entries export as CSV or JSON, and a closed case can retain its evidence, timeline, disposition and closure reason. A report or audit export supplies records for your review.
2What do the framework mappings mean?
Imperum is mapped to 37 security and compliance frameworks. These are mappings in the product, not certifications Imperum holds. Reports organize records for review; the reviewer assesses what those records demonstrate.
3What does an audit entry record?
The Audit Log records user actions, API calls and system events with the actor, timestamp, action type and before-and-after values. Review the permitted scope and selected period before exporting records as CSV or JSON.
Have any other questions? Talk to our team
Answer the audit request
from the work itself.
Walk through case evidence, report templates and audit exports with the Imperum team.