Enum AuditEventType 

pub enum AuditEventType {
    AuthSuccess {
        user_id: String,
    },
    AuthFailure {
        user_id: Option<String>,
        reason: String,
    },
    AccessGranted {
        user_id: String,
        resource: String,
    },
    AccessDenied {
        user_id: String,
        resource: String,
        reason: String,
    },
    ThreatDetected {
        client_id: String,
        threat_count: u32,
    },
    ThreatBlocked {
        client_id: String,
        threat_type: String,
    },
    NeutralizationStarted {
        client_id: String,
        threat_id: String,
        threat_type: String,
    },
    NeutralizationCompleted {
        client_id: String,
        threat_id: String,
        action: String,
        duration_ms: u64,
    },
    NeutralizationFailed {
        client_id: String,
        threat_id: String,
        error: String,
    },
    NeutralizationSkipped {
        client_id: String,
        threat_id: String,
        reason: String,
    },
    NeutralizationRolledBack {
        client_id: String,
        threat_id: String,
        reason: String,
    },
    RateLimitTriggered {
        client_id: String,
        limit_type: String,
    },
    ConfigChanged {
        changed_by: String,
        changes: HashMap<String, String>,
    },
    ConfigReloaded {
        success: bool,
        error: Option<String>,
    },
    PluginLoaded {
        plugin_id: String,
        plugin_name: String,
    },
    PluginUnloaded {
        plugin_id: String,
        reason: String,
    },
    PluginError {
        plugin_id: String,
        error: String,
    },
    ServerStarted {
        version: String,
    },
    ServerStopped {
        reason: String,
    },
    SystemError {
        component: String,
        error: String,
    },
    Custom {
        event_type: String,
        data: Value,
    },
}

Audit event types

Each event type captures specific security-relevant activities with fields required for compliance reporting and forensic analysis.

Compliance Requirements Matrix

Event Category	GDPR	SOC2	HIPAA	PCI DSS	ISO 27001
Authentication	✓	✓	✓	✓	✓
Authorization	✓	✓	✓	✓	✓
Security	○	✓	✓	✓	✓
Configuration	○	✓	○	✓	✓
System	○	✓	○	○	✓

Legend: ✓ = Required, ○ = Recommended

Variants

AuthSuccess

Successful authentication event

Triggered when: User successfully authenticates to the system

Required fields:

• user_id: Unique identifier of the authenticated user (required)

Additional context to capture:

• authentication_method: (e.g., “password”, “mfa”, “sso”)
• session_id: New session identifier
• ip_address: Source IP (auto-captured)
• user_agent: Client information (auto-captured)

Compliance requirements:

• GDPR: Required for access logs and user activity tracking
• SOC2: Required for access control monitoring (AC-2)
• HIPAA: Required for user activity tracking (§164.312(b))
• PCI DSS: Required for individual user access (8.1.1)
• ISO 27001: Required for access control (A.9.2.1)

Typical severity: Info

Fields

user_id: String

AuthFailure

Failed authentication attempt

Triggered when: Authentication attempt fails for any reason

Required fields:

• user_id: Attempted username (optional - may be None for invalid users)
• reason: Specific failure reason (required)

Additional context to capture:

• attempt_count: Number of consecutive failures
• authentication_method: Method attempted
• ip_address: Source IP (auto-captured)
• lockout_triggered: Whether account was locked

Compliance requirements:

• SOC2: Required for security monitoring (CA-7)
• HIPAA: Required for login monitoring (§164.308(a)(5)(ii)(C))
• PCI DSS: Required after 6 attempts (8.1.6)
• ISO 27001: Required for security incident detection

Typical severity: Warning (Error if repeated, Critical if threshold exceeded)

Fields

user_id: Option<String>

reason: String

AccessGranted

Successful resource access

Triggered when: User successfully accesses a protected resource

Required fields:

• user_id: User performing the access (required)
• resource: Resource identifier/path (required)

Additional context to capture:

• action: Specific action performed (read/write/delete)
• resource_type: Type of resource accessed
• data_classification: Sensitivity level of data

Compliance requirements:

• GDPR: Required for personal data access (Article 30)
• SOC2: Required for logical access monitoring
• HIPAA: Required for PHI access logs (§164.312(a)(1))
• PCI DSS: Required for cardholder data access (10.2.1)

Typical severity: Info

Fields

user_id: String

resource: String

AccessDenied

Denied resource access attempt

Triggered when: User is denied access to a protected resource

Required fields:

• user_id: User attempting access (required)
• resource: Resource identifier/path (required)
• reason: Denial reason (required)

Additional context to capture:

• required_permission: Permission that was missing
• user_permissions: Current user permissions
• escalation_attempted: If privilege escalation was detected

Compliance requirements:

• SOC2: Required for unauthorized access attempts
• HIPAA: Required for access violation tracking
• PCI DSS: Required for all access denials (10.2.4)
• ISO 27001: Required for security monitoring

Typical severity: Warning (Critical if privilege escalation detected)

Fields

user_id: String

resource: String

reason: String

ThreatDetected

Security threat detected

Triggered when: System detects potential security threats

Required fields:

• client_id: Client/session where threat originated (required)
• threat_count: Number of threats detected (required)

Additional context to capture:

• threat_types: Array of specific threat types detected
• threat_details: Detailed threat information
• risk_score: Calculated risk level (0-100)
• automated_response: Actions taken automatically

Compliance requirements:

• SOC2: Required for security monitoring (SI-4)
• HIPAA: Required for malicious software detection
• PCI DSS: Required for intrusion detection (11.5)
• ISO 27001: Required for security event logging

Typical severity: Warning to Critical (based on threat severity)

Fields

client_id: String

threat_count: u32

ThreatBlocked

Security threat blocked

Triggered when: System successfully blocks a security threat

Required fields:

• client_id: Client/session where threat originated (required)
• threat_type: Type of threat blocked (required)

Additional context to capture:

• block_method: How the threat was blocked
• threat_signature: Pattern/signature that matched
• confidence_score: Detection confidence (0-100)
• false_positive_probability: Likelihood of false positive

Compliance requirements:

• SOC2: Required for incident response (IR-4)
• PCI DSS: Required for security controls (6.6)
• ISO 27001: Required for security control effectiveness

Typical severity: Critical

Fields

client_id: String

threat_type: String

NeutralizationStarted

Threat neutralization initiated

Triggered when: System begins automated threat neutralization

Required fields:

• client_id: Client being protected (required)
• threat_id: Unique threat identifier (required)
• threat_type: Type of threat being neutralized (required)

Additional context to capture:

• neutralization_strategy: Method being used
• estimated_duration: Expected completion time
• impact_assessment: Potential user impact

Compliance requirements:

• SOC2: Required for automated response tracking
• ISO 27001: Required for incident handling (A.16.1)

Typical severity: Warning

Fields

client_id: String

threat_id: String

threat_type: String

NeutralizationCompleted

Threat neutralization completed successfully

Triggered when: Threat neutralization completes successfully

Required fields:

• client_id: Client that was protected (required)
• threat_id: Unique threat identifier (required)
• action: Specific action taken (required)
• duration_ms: Time taken in milliseconds (required)

Additional context to capture:

• effectiveness_score: How well the threat was neutralized
• side_effects: Any unintended consequences
• rollback_available: Whether action can be reversed

Compliance requirements:

• SOC2: Required for incident resolution tracking
• ISO 27001: Required for corrective action records

Typical severity: Info

Fields

client_id: String

threat_id: String

action: String

duration_ms: u64

NeutralizationFailed

Threat neutralization failed

Triggered when: Neutralization attempt fails

Required fields:

• client_id: Client affected (required)
• threat_id: Unique threat identifier (required)
• error: Error description (required)

Additional context to capture:

• fallback_action: Alternative action taken
• manual_intervention_required: Whether human action needed
• threat_persists: Whether threat is still active

Compliance requirements:

• SOC2: Required for incident escalation
• ISO 27001: Required for control failure documentation

Typical severity: Error to Critical

Fields

client_id: String

threat_id: String

error: String

NeutralizationSkipped

Neutralization skipped by policy

Triggered when: Neutralization skipped due to policy/configuration

Required fields:

• client_id: Client affected (required)
• threat_id: Unique threat identifier (required)
• reason: Why neutralization was skipped (required)

Additional context to capture:

• policy_name: Specific policy that prevented action
• override_available: Whether manual override possible

Compliance requirements:

• SOC2: Required for policy compliance tracking

Typical severity: Warning

Fields

client_id: String

threat_id: String

reason: String

NeutralizationRolledBack

Neutralization action rolled back

Triggered when: Previous neutralization is reversed

Required fields:

• client_id: Client affected (required)
• threat_id: Unique threat identifier (required)
• reason: Rollback reason (required)

Additional context to capture:

• original_action: What was rolled back
• rollback_complete: Whether fully reversed
• initiated_by: Automatic or manual rollback

Compliance requirements:

• SOC2: Required for change management
• ISO 27001: Required for corrective action tracking

Typical severity: Warning

Fields

client_id: String

threat_id: String

reason: String

RateLimitTriggered

Rate limit exceeded

Triggered when: Client exceeds configured rate limits

Required fields:

• client_id: Client that triggered limit (required)
• limit_type: Type of limit exceeded (required)

Additional context to capture:

• limit_value: The limit that was exceeded
• current_value: Current usage value
• reset_time: When limit will reset
• blocked_requests: Number of requests blocked

Compliance requirements:

• SOC2: Required for availability monitoring
• PCI DSS: Required for DoS protection (6.6)

Typical severity: Warning

Fields

client_id: String

limit_type: String

ConfigChanged

Configuration modified

Triggered when: System configuration is changed

Required fields:

• changed_by: User/system that made change (required)
• changes: Map of changed settings (required)

Additional context to capture:

• change_reason: Business justification
• approval_ticket: Change management reference
• rollback_plan: How to reverse if needed
• security_impact: Security implications

Compliance requirements:

• SOC2: Required for change management (CC6.1)
• PCI DSS: Required for configuration tracking (2.2)
• ISO 27001: Required for change control (A.12.1.2)

Typical severity: Info (Warning for security settings)

Fields

changed_by: String

changes: HashMap<String, String>

ConfigReloaded

Configuration reloaded

Triggered when: Configuration is reloaded from source

Required fields:

• success: Whether reload succeeded (required)
• error: Error message if failed (optional)

Additional context to capture:

• trigger: What initiated the reload
• config_version: New configuration version
• validation_results: Configuration validation outcome

Compliance requirements:

• SOC2: Required for operational monitoring

Typical severity: Info (Error if failed)

Fields

success: bool

error: Option<String>

PluginLoaded

Plugin loaded

Triggered when: Security plugin is loaded

Required fields:

• plugin_id: Unique plugin identifier (required)
• plugin_name: Human-readable name (required)

Additional context to capture:

• plugin_version: Version information
• plugin_vendor: Plugin creator/vendor
• plugin_signature: Digital signature status
• capabilities: What the plugin can access

Compliance requirements:

• SOC2: Required for third-party management
• ISO 27001: Required for supplier relationships

Typical severity: Info

Fields

plugin_id: String

plugin_name: String

PluginUnloaded

Plugin unloaded

Triggered when: Security plugin is unloaded

Required fields:

• plugin_id: Unique plugin identifier (required)
• reason: Why plugin was unloaded (required)

Additional context to capture:

• initiated_by: Manual or automatic unload
• cleanup_status: Whether resources were freed

Compliance requirements:

• SOC2: Required for component lifecycle tracking

Typical severity: Info (Warning if error-triggered)

Fields

plugin_id: String

reason: String

PluginError

Plugin error

Triggered when: Plugin encounters an error

Required fields:

• plugin_id: Plugin that errored (required)
• error: Error description (required)

Additional context to capture:

• error_code: Specific error code
• stack_trace: Technical details (sanitized)
• recovery_action: Automatic recovery attempted

Compliance requirements:

• SOC2: Required for third-party monitoring

Typical severity: Error

Fields

plugin_id: String

error: String

ServerStarted

Server started

Triggered when: Security server starts up

Required fields:

• version: Server version (required)

Additional context to capture:

• startup_time_ms: Time to become operational
• config_source: Where configuration was loaded from
• features_enabled: Active feature flags
• security_mode: Current security posture

Compliance requirements:

• SOC2: Required for availability tracking
• ISO 27001: Required for operational procedures

Typical severity: Info

Fields

version: String

ServerStopped

Server stopped

Triggered when: Security server shuts down

Required fields:

• reason: Shutdown reason (required)

Additional context to capture:

• shutdown_type: Graceful or forced
• active_connections: Connections at shutdown
• cleanup_complete: Whether cleanup finished

Compliance requirements:

• SOC2: Required for availability tracking
• ISO 27001: Required for operational procedures

Typical severity: Info (Error if unexpected)

Fields

reason: String

SystemError

System error

Triggered when: System-level error occurs

Required fields:

• component: System component affected (required)
• error: Error description (required)

Additional context to capture:

• error_type: Category of error
• impact: User/system impact assessment
• auto_recovery: Whether self-healing attempted

Compliance requirements:

• SOC2: Required for system monitoring
• ISO 27001: Required for incident management

Typical severity: Error to Critical

Fields

component: String

error: String

Custom

Custom audit event

Triggered when: Application needs to log custom security events

Required fields:

• event_type: Custom event type name (required)
• data: Event-specific data (required)

Additional context to capture:

• Should follow same context patterns as standard events
• Must include compliance-relevant fields

Compliance requirements:

• Must map to appropriate compliance categories
• Must include required fields for relevant standards

Typical severity: Varies by event type

Fields

event_type: String

data: Value

Trait Implementations

impl Clone for AuditEventType

fn clone(&self) -> AuditEventType

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AuditEventType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AuditEventType

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AuditEventType

impl PartialEq for AuditEventType

fn eq(&self, other: &AuditEventType) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for AuditEventType

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AuditEventType