34 lines
733 B
Markdown
34 lines
733 B
Markdown
# Audit Logging
|
|
|
|
## Design
|
|
|
|
Audit logs are append-only JSON lines with hash chaining:
|
|
- `prev_hash`: previous entry hash.
|
|
- `entry_hash`: hash of current entry payload + previous hash.
|
|
|
|
This makes tampering detectable.
|
|
|
|
## Event Types
|
|
|
|
- `tool_invocation`
|
|
- `access_denied`
|
|
- `security_event`
|
|
|
|
Each event includes timestamps and correlation context.
|
|
|
|
## Integrity Validation
|
|
|
|
Use:
|
|
|
|
```bash
|
|
python3 scripts/validate_audit_log.py --path /var/log/aegis-mcp/audit.log
|
|
```
|
|
|
|
Exit code `0` indicates valid chain, non-zero indicates tamper/corruption.
|
|
|
|
## Operational Expectations
|
|
|
|
- Persist audit logs to durable storage.
|
|
- Protect write permissions (service account only).
|
|
- Validate integrity during incident response and release checks.
|