Drata provides several ways to manually download evidence data directly from the platform. However, there is currently no single workflow that supports exporting all evidence in bulk without using the API. Instead, evidence must be downloaded from different areas of the application depending on how it is stored or generated.
This guide outlines the available methods for manually exporting evidence data, including how the Audit Hub can be used to collect a consolidated subset of evidence for a defined time period.
Methods to Export Evidence Data
1. Using the Evidence Library
The Evidence Library acts as a centralized repository for evidence files that have been uploaded or generated and linked to controls.
To download evidence from the Evidence Library:
Navigate to Evidence Library in the Drata.
Select the evidence you need.
Select the download icon within the artifact section.
This method works well for targeted exports, but files must be downloaded one at a time, which can be time-consuming for large datasets.
2. Accessing Evidence Linked to Controls
Evidence is often associated directly with individual controls. To download evidence from a control:
Navigate to Controls.
Select a specific control.
Open the Evidence tab. Evidence tab is only available for those opted into Early Access.
Select the download icon on the top right corner of the table.
A notification near the bottom right corner appears when the download is complete.
This approach is practical for reviewing or exporting evidence tied to a small number of controls, but it does not scale efficiently when many controls are involved.
3. Downloading Raw Evidence from Events
Some evidence is generated through event tracking. To access raw event evidence:
Navigate to the Event Tracking page.
Select an event to view its details.
You can choose:
Show raw evidence: Copy the JSON output.
Raw Evidence and Event Details .pdf: Get a PDF file that contains raw evidence along with event details.
Raw result .txt: Get a TXT file that only shows raw result.
This method is best suited for individual event records rather than broad evidence collection.
4. Using the Audit Hub to Collect Evidence by Date Range
The Audit Hub can be used to compile a set of evidence files for a specific audit period. While this is not a true bulk export of all evidence, it provides a centralized way to gather relevant documentation for a defined timeframe.
To use the Audit Hub:
Navigate to Audit Hub.
Create a new audit.
Specify a date range to scope the audit.
Once the audit is created, download the Pre-Audit package.
Alternatively, you can navigate to an existing audit and select the Pre-Audit package from the audit details.
The Pre-Audit package includes evidence files that fall within the selected date range and are associated with the audit, primarily drawing from the Evidence Library and related control evidence. It may not include every type of evidence stored elsewhere in the platform.
Summary and Best Practices
For small or targeted exports, use the Evidence Library, Controls, or Events pages.
Use the Audit Hub when you need a consolidated evidence package for a specific audit period, understanding that it represents a scoped subset, not a complete export of all evidence.
Always review downloaded files to confirm they meet your requirements before finalizing your documentation or sharing with auditors.
Using these approaches, you can manually gather evidence from Drata while working within the platform’s current download capabilities.