Northfield Financial Group

Northfield's infrastructure team had grown organically to five different monitoring tools across various acquisitions — none of which had a real audit trail an internal security reviewer could rely on.

The problem

An internal compliance review flagged that infrastructure changes couldn't be reliably traced to a specific admin action across most of the existing tools — some had no audit log at all, others allowed logs to be edited or deleted by an admin.

What changed

Northfield standardized on MonSPHERE specifically because its audit log is append-only at the database level — a trigger rejects any UPDATE or DELETE against the audit_logs table, so "can't be tampered with" is a database guarantee the reviewer could independently verify, not a policy the application merely promises to follow.

On top of that, Northfield enabled MFA for every admin-level account:

curl -X POST https://api.monsphere.com/api/v1/auth/mfa/setup \
  -H "Authorization: Bearer $ACCESS_TOKEN"

and composed a custom "Compliance Reviewer" role scoped to exactly audit:read — nothing else — so the internal review team could query the audit trail without any ability to modify infrastructure.

Results

The next compliance review found zero gaps in the audit trail and confirmed MFA coverage across 100% of admin accounts. Northfield's infrastructure team also picked up incident and alerting consolidation as a side effect of the migration — five tools' worth of alert noise became one Alertmanager-backed pipeline.

Why it mattered

For a financial services IT organization, the audit guarantee mattered more than any dashboard feature — MonSPHERE was the first monitoring platform Northfield's security team was willing to sign off on without exceptions.