{"action":"created","issue":{"url":"https://api.github.com/repos/sapcc/limes/issues/57","repository_url":"https://api.github.com/repos/sapcc/limes","labels_url":"https://api.github.com/repos/sapcc/limes/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/sapcc/limes/issues/57/comments","events_url":"https://api.github.com/repos/sapcc/limes/issues/57/events","html_url":"https://github.com/sapcc/limes/pull/57","id":343629548,"node_id":"MDExOlB1bGxSZXF1ZXN0MjAzMjE2Mzk2","number":57,"title":"proposal: CADF audit trail","user":{"login":"MTalalAnwar","id":3526562,"node_id":"MDQ6VXNlcjM1MjY1NjI=","avatar_url":"https://avatars1.githubusercontent.com/u/3526562?v=4","gravatar_id":"","url":"https://api.github.com/users/MTalalAnwar","html_url":"https://github.com/MTalalAnwar","followers_url":"https://api.github.com/users/MTalalAnwar/followers","following_url":"https://api.github.com/users/MTalalAnwar/following{/other_user}","gists_url":"https://api.github.com/users/MTalalAnwar/gists{/gist_id}","starred_url":"https://api.github.com/users/MTalalAnwar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MTalalAnwar/subscriptions","organizations_url":"https://api.github.com/users/MTalalAnwar/orgs","repos_url":"https://api.github.com/users/MTalalAnwar/repos","events_url":"https://api.github.com/users/MTalalAnwar/events{/privacy}","received_events_url":"https://api.github.com/users/MTalalAnwar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-07-23T13:18:53Z","updated_at":"2018-07-24T22:18:02Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/sapcc/limes/pulls/57","html_url":"https://github.com/sapcc/limes/pull/57","diff_url":"https://github.com/sapcc/limes/pull/57.diff","patch_url":"https://github.com/sapcc/limes/pull/57.patch"},"body":"&ast;*In Limes terminology: event = quota change*\r\n\r\nCurrently Limes logs all API requests to the standard output and standard error streams.\r\n\r\nFor PUT requests, Limes logs each individual quota change in the following format:\r\n\r\n```bash\r\nAUDIT: set quota compute.instances = 0 -> 50 for domain ca1b267e149d4e44bf53d28d1c8d6bc9 by user 6loremipsum888loremipsum888loremipsum888loremipsum6 (D-user_id)\r\n```\r\n\r\nHermes workflow: audit events from Keystone Middleware > oslo messaging bus held by RabbitMQ > Logstash transforms (adds domain and project metadata) events > ElasticSearch holds the events > Hermes API displays the events through HTTP requests or Elektra as front-end.\r\n\r\nThe proposal:\r\n\r\n1. All Limes API `PUT` requests at the domain and project level get intercepted.\r\n2. Transform these into a CADF formatted event.\r\n3. Send these events to either an Elasticsearch setup; for our purpose we send events to Hermes' Elasticsearch setup.\r\n4. Audit trail can be viewed through Elektra with Hermes as the back-end.\r\n\r\nStep 1 was already implemented in Limes. I have done a crude (not all the info is transformed to CADF) implementation of Step 2, I will push it to this branch as soon as it is fully implemented.\r\n\r\nCurrent implementation of Step 2 looks like this:\r\n\r\n```bash\r\n2018/07/23 14:50:55 AUDIT: {\"domain_id\":\"ca1b267e149d4e44bf53d28d1c8d6bc9\",\"service\":\"compute\",\"resource\":\"cores\",\"newQuota\":85}\r\n2018/07/23 14:50:55 AUDIT: {\"domain_id\":\"ca1b267e149d4e44bf53d28d1c8d6bc9\",\"service\":\"compute\",\"resource\":\"instances\",\"newQuota\":40}\r\n2018/07/23 14:50:55 AUDIT: {\"domain_id\":\"ca1b267e149d4e44bf53d28d1c8d6bc9\",\"service\":\"object-store\",\"resource\":\"capacity\",\"newQuota\":41943040000}\r\n```\r\n\r\nAdditionally, I have also written an initial draft of the audit trail guide/spec available at `./docs/users/audit.md`. My intention is to create a guide that the reader can use to follow the audit trail and extract the required information from the audit event without having to go through the official (read: lengthy) CADF spec.\r\n"},"comment":{"url":"https://api.github.com/repos/sapcc/limes/issues/comments/407570352","html_url":"https://github.com/sapcc/limes/pull/57#issuecomment-407570352","issue_url":"https://api.github.com/repos/sapcc/limes/issues/57","id":407570352,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNzU3MDM1Mg==","user":{"login":"notque","id":220916,"node_id":"MDQ6VXNlcjIyMDkxNg==","avatar_url":"https://avatars2.githubusercontent.com/u/220916?v=4","gravatar_id":"","url":"https://api.github.com/users/notque","html_url":"https://github.com/notque","followers_url":"https://api.github.com/users/notque/followers","following_url":"https://api.github.com/users/notque/following{/other_user}","gists_url":"https://api.github.com/users/notque/gists{/gist_id}","starred_url":"https://api.github.com/users/notque/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/notque/subscriptions","organizations_url":"https://api.github.com/users/notque/orgs","repos_url":"https://api.github.com/users/notque/repos","events_url":"https://api.github.com/users/notque/events{/privacy}","received_events_url":"https://api.github.com/users/notque/received_events","type":"User","site_admin":false},"created_at":"2018-07-24T22:18:02Z","updated_at":"2018-07-24T22:18:02Z","author_association":"NONE","body":"Looks good so far. First guess is entry point is a rabbitmq for limes picked up by our logstash keeping things consistent, and handling our rolling indexes properly.  \r\n\r\nGetting the fields right which you've properly specified in the audit.md\r\n\r\nBut it all makes sense, great work sorting it out so far.\r\n\r\n"}}
{"actor":{"display_login":"notque"}}