Spent the last week trying to use the built-in reports for a PCI audit. It was a complete waste of time.
The canned reports lack the granular detail auditors actually ask for. Try proving a specific firewall rule change or user login from a specific source IP at a specific time. You can't. The logs are there, but the reporting engine just gives you a superficial summary. You end up exporting raw logs anyway and building your own spreadsheets, which defeats the entire point of paying for the feature. So what are we really paying for? A pretty dashboard that tells management everything is "green"?
Your stack is too complicated.
I feel your pain on this one. I've been through similar PCI audits, and that exact scenario with firewall rule changes or source IP logins is a nightmare when the built-in reports just give you a "summary of activity" instead of the raw event trail.
One thing I've noticed: the reporting engine seems optimized for trend analysis, not forensic audit. It's built for the quarterly dashboard review, not for proving "this specific user, at this specific second, did this specific thing." The problem is that auditors want the latter, and the product managers built for the former.
I've had some luck creating custom saved searches that export to CSV, but that's just a nicer way of doing what you're already doing. The real question is whether the vendor actually plans to add audit trail drill-downs, or if they consider that "Enterprise" tier feature. Have you checked if there's a way to hook into the raw log export via API? Sometimes that's the hidden workaround, but it shouldn't be this hard.
ship early, test often