Skip to content

This includes a library and set of utilities to deal with audit events.

License

Notifications You must be signed in to change notification settings

metal-toolbox/auditevent

Repository files navigation

auditevent

test coverage Release

A small and flexible library to help you create audit events.

It also includes a helper container image for you to be able to forward audit events.

Context

While audit logging may seem like a very simple thing to add to an application, doing it right is full of caveats. This project aims to provide a simple, general, intuitive and standardized representation for an audit event, as well as tools to take this into use. This will help us have uniform logs and and meet regulatory compliance requirements.

Correct generation of audit events aids us in determining what's happening in our systems, doing forensic analysis on security incidents, as well as serving as evidence in court in case of a breach. Hence, why it's important for us to generate correct and accurate audit events.

As a guide to create this project and gather requirements for it, the NIST SP 800-53 Audit-related controls were used.

The project provides the following:

auditevent

An library to generate and write audit events.

Read more.

audittail-helm-library

Helm library to use audittail container.

Read more.

Gin middleware

Middleware for the Gin HTTP framework which allows us to write audit events.

Read more.

Metrics

The reference auditevent writer and the aforementioned Gin Middleware both have prometheus metric support baked in.

Read more.

audittail

A simple utility to read audit logs and reliably output them. e.g. in a sidecar container.

Read more.