---
title: Tamper Proof Use Case
slug: kronpam-legacy-ui-reference-guide-3-5-0/tamper-proof-use-case
description: Learn how to access the Tamper Proof feature in log screens with this step-by-step guide. Activate the Show Tamper Proof Status filter in the User Auth Logs section for added security. Discover the log record statuses, including Original, Tampered, and Un
docTags: 
createdAt: 2022-08-02T09:44:50.000Z
---

The Tamper Proof feature can be accessed in log screens, such as Session Logs, HTTP Proxy Logs, Activity Logs, Command Logs, Authentication Logs, Event Logs, and Video Logs.

1. Navigate to **Logging** >** User Auth Logs**.
2. Select** Show Tamper Proof Status** and filter other parameters, as needed.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/O9CgBDHhgS5zrZHzAlZ9S_image.png "User Auth Logs Section with applied Show Tamper Proof Filter ")

- Click the **Search** button to list all the results. The list includes an extra column called **Tamper Proof**, which represents the status of each log record.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/gAxujOaZYEE99T0TVKqty_image.png "User Auth Logs Search List with applied Show Tamper Proof Filter")



- If the log record is tagged as **Original**, there are no changes. If the log record is tagged as **Tampered**, it means that he log record has somehow been changed in the database by a malicious user. If there is any undue modification of log record name, time, client IP, hash info etc., the tamper proof mechanism identifies it and flags it as **Tampered**. If the log record is tagged as **Unknown**, it has not yet been hashed by the batch process. Once it is hashed in the background, its status will be updated to **Original **or **Tampered**.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/UCqyAMSWGpFez3WKVgPIL_image.png "Example User Auth Logs with and without Modifications")

- Any user searches of the log record with tamper-proof status will be recorded as an activity log, as illustrated in the figure below. Set the **Event Type** filter as /log/activity-log/search-tamper-proof/ and click **Search** to see the results. Information on which users searched for tamper-proof status includes Time, Instance Name, Event Type, and Event Parameter information.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/273IJuzqU00cFR4uMqPLG_image.png "Tamper Proof Log Search Results")