Module audit 

Chronix Audit — Structured Audit Logging

Captures security-relevant operations as structured audit events with pluggable sinks (memory, file, tracing) and queryable storage.

Architecture

Authorization Decision  ──┐
Authentication Event    ──┤
Admin Operation         ──┤──→ AuditLogger ──→ AuditSink(s)
Signal / Trigger Event  ──┘       │               ├── MemorySink (queryable)
                                  │               ├── WriterSink (JSON lines)
                                  │               ├── TracingSink (structured logs)
                                  │               └── WebhookSink (HTTP POST, JSON/CEF)
                                  │
                                  └── Sequence numbers + metrics

SIEM Integration

Built-in WebhookSink forwards events via HTTP POST (JSON or CEF format) with configurable auth, retries, and backpressure. Additional integration options:

1. Webhook: use WebhookSink (feature webhook) to POST events directly to Splunk HEC, Elastic, Sentinel, or any HTTP endpoint. Supports JSON and CEF formats.
2. File → agent: use WriterSink with JSON-lines output and configure a log shipper (Filebeat, Fluentd, Vector) to ingest the file into your SIEM pipeline.
3. Custom sink: implement AuditSink and push events directly via the SIEM’s HTTP/gRPC ingest API.
4. Tracing → OTLP: use TracingSink combined with the chronixd’s OTLP exporter; many SIEMs accept OTLP.

Option 1 is recommended for most deployments. Option 2 is preferred when you need to decouple audit durability from network availability.

Example

use chronix_security::audit::{AuditLogger, AuditEvent, AuditAction, AuditDecision, MemorySink};
use std::sync::Arc;

// Create logger with memory sink
let sink = Arc::new(MemorySink::new(10_000));
let mut logger = AuditLogger::new();

// Log an authorization decision
let event = AuditEvent::new("alice", AuditAction::Write, "cpu", AuditDecision::Allow)
    .with_source_ip("10.0.0.1")
    .with_request_id("req-001");
// logger.log(event);

Re-exports

pub use error::AuditError;

Modules

error

Error types for the audit logging system.

Structs

AuditEvent

A structured audit event capturing a security-relevant operation.

AuditLogger

The main audit logger, dispatching events to configured sinks.

FileSink

An append-only audit file, one JSON event per line.

MemorySink

In-memory audit sink, useful for testing and querying.

TracingSink

Emits audit events as structured tracing events.

WebhookConfig

Configuration for the webhook sink.

WebhookSink

HTTP webhook audit sink for SIEM integration.

WriterSink

Writes audit events as JSON lines to an io::Write destination.

Enums

AuditAction

Category of auditable actions.

AuditDecision

The result of an authorization decision or operation.

WebhookFormat

Output format for webhook events.

Traits

AuditSink

Pluggable sink for audit event output.

Functions

last_event

The last event of an audit log, for anchoring a new chain onto it.

read_events

Read every sealed event from an audit log, oldest first.

verify_chain_from

Verify a chain that continues from an earlier one.

verify_hash_chain

Verify the integrity of a hash chain produced by AuditLogger.

verify_hash_chain_with_key

Verify the hash chain with an optional HMAC key.