---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Change audit data

# Code Signing change audit data {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Review the create, update, and delete operations that users perform on records protected by Code Signing.
Code Signing records create, update, and delete operations on a protected record in the sn_cse_vault_codesigning_audit_data table. Use this audit data to identify who changed a protected record, which record they changed, and when
the change occurred.

Audit data is written by the platform after Code Signing is activated on your instance.

## Operations that generate audit data {#cs-vault-audit-data__section_what_is_logged}

The platform writes an audit record only when all of the following conditions are true:

* Code Signing is activated on the instance. The com.snc.kmf.signature.validation.optin property is set to true.
* The sn_cse.com.snc.csf.vault_audit_enabled property is set to true. This property is set to true by default.
* The instance is a production instance. Development and test instances don't generate audit data.
* The record belongs to a table that has a Code Signing signature configuration. If the signature configuration includes a signature generation filter, the record must also match that filter.
* The table isn't listed in the com.glide.codesigning.tables.excluded_from_audit property. By default, this property excludes the internal tables that Code Signing uses for certificate storage, cryptographic module and policy configuration, and signing job tracking.

{#cs-vault-audit-data__ul_audit_conditions}

For descriptions of these properties, see [Properties installed with Code Signing](https://www.servicenow.com/docs/0Ud2C7Cw3wekgHOH1lM5Bw "Code Signing adds the following properties.").

## Audit record fields {#cs-vault-audit-data__section_columns}

{#cs-vault-audit-data__table_vault_audit_fields__entry__2}

| Field | Description |
|-|-|
| Application scope (sys_scope) | Application scope that the changed record belongs to. |
| Package (sys_package) | Package that the changed record belongs to. |
| Document ID (document_id) | Sys ID of the changed record. |
| Table name (table_name) | Table that contains the changed record. |
| Modified by (modified_by) | User who performed the operation. |
| Modified on (modified_on) | Date and time when the operation occurred. |
| Operation (operation) | Type of operation: <kbd class="ph userinput">create</kbd>, <kbd class="ph userinput">update</kbd>, or <kbd class="ph userinput">delete</kbd>. If the platform can't determine the operation type, the value is <kbd class="ph userinput">unknown</kbd>. |
[Table 1. Audit data table fields]

{#cs-vault-audit-data__table_vault_audit_fields}

## Access to audit data {#cs-vault-audit-data__section_access}

Users with the sn_cse.codesigning_auditor role can view the audit data and report on it. For more information about this role,
see [Code signing auditor \[codesigning_auditor\]](nxaL3OAWtLVRY4OAmd2MUQ#cs-role-3 "Use the code signing auditor role to view signature configurations, signing jobs, and Code Signing change audit data. The auditor role does not have create or write access to code signing assets.").

Create, update, and delete operations on the sn_cse_vault_codesigning_audit_data table are restricted to the platform. No role grants write access to this table.

## Audit data retention {#cs-vault-audit-data__section_retention}

The Vault Code Signing Audit Data Cleaner scheduled job runs every 12 hours and removes audit records in two passes:

1. Deletes audit records that are older than the retention period set in the sn_cse.com.snc.csf.vault_audit_data_retention_days property. The default retention period is 90 days. Valid values are 30 through 360. If you set a value outside this range, the job uses the nearest limit and the property value remains unchanged.
2. Compares the remaining record count against the sn_cse.com.snc.csf.vault_audit_data_max_size property, which is set to 9,000 records by default. If the count is higher, the job deletes the oldest records until the count matches the configured maximum.

{#cs-vault-audit-data__ol_cleanup_passes}

Only a user with the sn_cse.codesigning_admin role can change these properties. Export the audit data that you want to keep for
longer than the retention period.  
Note:  
Because the job enforces a maximum record count, it can delete older audit records before the retention period ends when the record count exceeds the configured maximum.