You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/reference/polykey-core/audit.md
+34-17Lines changed: 34 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,22 @@
1
1
# Audit
2
2
3
-
The Audit system in Polykey provides a way to track and retrieve events that occur within the Polykey agent. This feature is essential for security monitoring, troubleshooting, and compliance purposes.
3
+
The Audit system in Polykey provides a way to track and retrieve events that
4
+
occur within the Polykey agent. This feature is essential for security
5
+
monitoring, troubleshooting, and compliance purposes.
4
6
5
7
## Overview
6
8
7
-
The Audit system records various events that occur during the operation of a Polykey node. These events are stored in a structured format and can be retrieved for analysis. The system is designed to be efficient and secure, with events stored in the node's database.
9
+
The Audit system records various events that occur during the operation of a
10
+
Polykey node. These events are stored in a structured format and can be
11
+
retrieved for analysis. The system is designed to be efficient and secure, with
12
+
events stored in the node's database.
8
13
9
14
## Core Components
10
15
11
16
### Audit Class
12
17
13
-
The `Audit` class is the main component of the audit system. It provides methods for:
18
+
The `Audit` class is the main component of the audit system. It provides methods
19
+
for:
14
20
15
21
- Recording audit events
16
22
- Retrieving audit events
@@ -22,13 +28,15 @@ Audit events have the following structure:
22
28
23
29
-`id`: A unique identifier for the event (AuditEventId)
24
30
-`path`: An array of strings representing the event category/path
25
-
-`data`: The event data, which can contain any relevant information about the event
31
+
-`data`: The event data, which can contain any relevant information about the
32
+
event
26
33
27
34
## Usage
28
35
29
36
### Retrieving Audit Events
30
37
31
-
Audit events can be retrieved from a node using the `nodesAuditEventsGet` RPC method. This method supports:
38
+
Audit events can be retrieved from a node using the `nodesAuditEventsGet` RPC
39
+
method. This method supports:
32
40
33
41
- Pagination through `seek` and `seekEnd` parameters
34
42
- Limiting the number of results with the `limit` parameter
@@ -39,10 +47,10 @@ Example usage through the node connection:
Each event type has a specific path structure and data format. The path is an array of strings that categorizes the event, while the data contains relevant information specific to that event type.
76
+
Each event type has a specific path structure and data format. The path is an
77
+
array of strings that categorizes the event, while the data contains relevant
78
+
information specific to that event type.
67
79
68
80
## Security Considerations
69
81
70
-
Audit events are stored locally on the node and are only accessible to authorized users with appropriate permissions. When retrieving audit events from another node, proper authentication and authorization are required.
82
+
Audit events are stored locally on the node and are only accessible to
83
+
authorized users with appropriate permissions. When retrieving audit events from
84
+
another node, proper authentication and authorization are required.
71
85
72
-
The audit system is designed to be secure and tamper-resistant, ensuring that audit events cannot be modified or deleted without proper authorization.
86
+
The audit system is designed to be secure and tamper-resistant, ensuring that
87
+
audit events cannot be modified or deleted without proper authorization.
73
88
74
89
## Integration with Other Components
75
90
@@ -99,8 +114,10 @@ The audit system is implemented using the following key files:
99
114
-`src/audit/Audit.ts`: The main Audit class implementation
100
115
-`src/audit/types.ts`: Type definitions for audit events
101
116
-`src/audit/utils.ts`: Utility functions for audit operations
102
-
-`src/nodes/agent/handlers/NodesAuditEventsGet.ts`: Handler for retrieving audit events
103
-
-`src/nodes/agent/callers/nodesAuditEventsGet.ts`: Caller for the audit events RPC method
117
+
-`src/nodes/agent/handlers/NodesAuditEventsGet.ts`: Handler for retrieving
118
+
audit events
119
+
-`src/nodes/agent/callers/nodesAuditEventsGet.ts`: Caller for the audit events
120
+
RPC method
104
121
105
122
## Future Enhancements
106
123
@@ -110,4 +127,4 @@ Future versions of the audit system may include:
110
127
- Enhanced filtering capabilities based on event paths and data
111
128
- Export functionality for audit logs to common formats (CSV, JSON)
112
129
- Integration with external logging systems (Syslog, ELK stack)
0 commit comments