chronix_security/audit/
mod.rs

1//! # Chronix Audit — Structured Audit Logging
2//!
3//! Captures security-relevant operations as structured audit events with
4//! pluggable sinks (memory, file, tracing) and queryable storage.
5//!
6//! ## Architecture
7//!
8//! ```text
9//! Authorization Decision  ──┐
10//! Authentication Event    ──┤
11//! Admin Operation         ──┤──→ AuditLogger ──→ AuditSink(s)
12//! Signal / Trigger Event  ──┘       │               ├── MemorySink (queryable)
13//!                                   │               ├── WriterSink (JSON lines)
14//!                                   │               ├── TracingSink (structured logs)
15//!                                   │               └── WebhookSink (HTTP POST, JSON/CEF)
16//!                                   │
17//!                                   └── Sequence numbers + metrics
18//! ```
19//!
20//! ## SIEM Integration
21//!
22//! Built-in [`WebhookSink`] forwards events via HTTP POST (JSON or CEF
23//! format) with configurable auth, retries, and backpressure. Additional
24//! integration options:
25//!
26//! 1. **Webhook**: use [`WebhookSink`] (feature `webhook`) to POST
27//!    events directly to Splunk HEC, Elastic, Sentinel, or any HTTP
28//!    endpoint. Supports JSON and CEF formats.
29//! 2. **File → agent**: use [`WriterSink`] with JSON-lines output and
30//!    configure a log shipper (Filebeat, Fluentd, Vector) to ingest
31//!    the file into your SIEM pipeline.
32//! 3. **Custom sink**: implement [`AuditSink`] and push events
33//!    directly via the SIEM's HTTP/gRPC ingest API.
34//! 4. **Tracing → OTLP**: use [`TracingSink`] combined with the
35//!    `chronixd`'s OTLP exporter; many SIEMs accept OTLP.
36//!
37//! Option 1 is recommended for most deployments. Option 2 is preferred
38//! when you need to decouple audit durability from network availability.
39//!
40//! ## Example
41//!
42//! ```no_run
43//! use chronix_security::audit::{AuditLogger, AuditEvent, AuditAction, AuditDecision, MemorySink};
44//! use std::sync::Arc;
45//!
46//! // Create logger with memory sink
47//! let sink = Arc::new(MemorySink::new(10_000));
48//! let mut logger = AuditLogger::new();
49//!
50//! // Log an authorization decision
51//! let event = AuditEvent::new("alice", AuditAction::Write, "cpu", AuditDecision::Allow)
52//!     .with_source_ip("10.0.0.1")
53//!     .with_request_id("req-001");
54//! // logger.log(event);
55//! ```
56
57#![warn(missing_docs)]
58#![deny(unsafe_code)]
59
60pub mod error;
61mod logger;
62mod model;
63#[cfg(test)]
64mod perf;
65#[cfg(feature = "webhook")]
66mod webhook;
67
68pub use error::AuditError;
69pub use logger::{
70    AuditLogger, AuditSink, FileSink, MemorySink, TracingSink, WriterSink, last_event, read_events,
71};
72pub use model::{
73    AuditAction, AuditDecision, AuditEvent, verify_chain_from, verify_hash_chain,
74    verify_hash_chain_with_key,
75};
76#[cfg(feature = "webhook")]
77pub use webhook::{WebhookConfig, WebhookFormat, WebhookSink};
chronix_security/audit/mod.rs

chronix_security/audit/
mod.rs
