Audit logs about cerbos

[emreb]

Should'nt this be part of the generic logging. PErhaps flags kinda like error, warning, info, debug etc.

…

On Sat, Feb 27, 2021 at 10:08 AM Charith Ellawala ***@***.***> wrote: We need to generate audit logs to keep track of all the authz decisions made by the system. They need to be written somewhere safe to prevent modification by attackers. (Could be as simple as using a container mounted volume that the users provide) — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <https://github.com/emreb/paams/issues/17>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABMF6CZH6F5SWLSXTJUO5DTBDACNANCNFSM4YJZGE3Q> .

[charithe]

I am going to defer this until we have a concrete set of requirements. Right now, audit logging can be approximated by setting server.logRequestPayloads: true in the config file and ingesting the cerbos.payload logger output using whatever log aggregator you have deployed to your environment.

Logging to files is quite messy in containerised environments and the 12-factor principles do not endorse it as well. Therefore we are not going to waste effort trying to support that. Ideally, audit logs are shipped directly to a SIEM agent or scraped from the aggregated logs. When we have a better set of requirements to work from, we can decide how the implementation would look like.

[emreb]

The common tool I keep hearing is Splunk. Is there a way to stream it to Splunk or make it work with Splunk?

…

On Tue, May 11, 2021 at 3:33 PM Charith Ellawala ***@***.***> wrote: I am going to defer this until we have a concrete set of requirements. Right now, audit logging can be approximated by setting server.logRequestPayloads: true in the config file and ingesting the cerbos.payload logger output using whatever log aggregator you have deployed to your environment. Logging to files is quite messy in containerised environments and the 12-factor principles <https://12factor.net/logs> do not endorse it as well. Therefore we are not going to waste effort trying to support that. Ideally, audit logs are shipped directly to a SIEM agent or scraped from the aggregated logs. When we have a better set of requirements to work from, we can decide how the implementation would look like. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABMF6HX6MQP442ISJEQZ5LTNE5Z3ANCNFSM4ZRVVLLA> .

[charithe]

We don't have to do anything special to integrate with Splunk, Elasticsearch, Graylog or whatever. They all work by having log shipping agents that scrape logs from different applications deployed to your environment. So, we are covered for the requirements in most places already.

[emreb]

"ingesting the cerbos.payload logger output using whatever log aggregator you have deployed to your environment" Can we put an example of how to do this in the documentation?

…

On Tue, May 11, 2021 at 4:04 PM Charith Ellawala ***@***.***> wrote: We don't have to do anything special to integrate with Splunk, Elasticsearch, Graylog or whatever. They all work by having log shipping agents that scrape logs from different applications deployed to your environment. So, we are covered for the requirements in most places already. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABMF6AFSPQS7APSFI4C4ALTNFBQFANCNFSM4ZRVVLLA> .

[charithe]

Hmm.. it's beyond the scope of application documentation. These things are fundamental infrastructure pieces that would already be in place.

[charithe]

Closed by #185