Expand description
Persistent audit-log backends. Append-only by API; SQL-level tampering is a separate concern (DB user perms, immudb, S3 delivery for archival).
Schema is intentionally flat — one row per event, JSON for the metadata bag — so SIEM pipelines (Datadog, Splunk, Loki) can parse with one query.