Shipping audit logs to SIEM

Stronghold audit logs are the main source of security events: who accessed which path, when, from which address, and with what result. For centralized analysis, ship them to a SIEM system.

General flow:

1. Enable one or more audit devices (file, syslog, socket).
2. Collect entries with a log shipping agent (log-shipper in Deckhouse Platform, Vector, Fluent Bit, rsyslog).
3. Parse JSON entries and map fields to the SIEM schema.

Choosing an audit device

Choose an audit device depending on how the SIEM system collects events:

Enable at least two audit devices: if writing to the audit log fails, Stronghold may stop serving requests. See Audit in Stronghold for details.

Example: a file for SIEM delivery and syslog as a backup channel:

d8 stronghold audit enable file file_path=/var/log/stronghold_audit.log
d8 stronghold audit enable syslog tag="stronghold" facility="AUTH"

Collection in Deckhouse Platform

In DP, logs are shipped by the log-shipper module. It reads pod logs and sends them to Elasticsearch, OpenSearch, Splunk, Logstash, Kafka, Loki, Vector, or over syslog.

For log-shipper to collect the audit log as pod logs, entries must be written to standard output. In DP (Stronghold EE, management.mode: Automatic), enable the audit log with the enableAuditLog parameter in the stronghold module’s ModuleConfig:

spec:
  settings:
    enableAuditLog: true

The module enables the stronghold_audit_stdout audit device (type file, file_path=stdout) itself. On EE, if the parameter is not set, the module disables the audit log. The parameter cannot be set when management.mode is Manual; in that case, as well as on a standalone installation, enable the device manually:

d8 stronghold audit enable -path=file-stdout file file_path=stdout

Example log-shipper configuration that sends Stronghold pod logs to Elasticsearch:

apiVersion: deckhouse.io/v1alpha1
kind: ClusterLoggingConfig
metadata:
  name: stronghold-audit
spec:
  type: KubernetesPods
  kubernetesPods:
    namespaceSelector:
      labelSelector:
        matchLabels:
          kubernetes.io/metadata.name: d8-stronghold
  destinationRefs:
    - siem-elasticsearch
---
apiVersion: deckhouse.io/v1alpha1
kind: ClusterLogDestination
metadata:
  name: siem-elasticsearch
spec:
  type: Elasticsearch
  elasticsearch:
    endpoint: https://elasticsearch.example.com:9200
    index: stronghold-audit-%F
    auth:
      strategy: Basic
      user: stronghold
      password: <BASE64_PASSWORD>

<BASE64_PASSWORD> is the password of the stronghold Elasticsearch user, base64-encoded.

Pod logs contain Stronghold operational logs along with audit entries. Separate audit entries by the presence of the type (request or response) and request.id fields.

Collection outside Kubernetes

For Stronghold on Linux, use any agent that can read a file with JSON lines. Example Vector configuration:

sources:
  stronghold_audit:
    type: file
    include:
      - /var/log/stronghold_audit.log

transforms:
  parse:
    type: remap
    inputs: [stronghold_audit]
    source: |
      . = parse_json!(.message)

sinks:
  siem:
    type: elasticsearch
    inputs: [parse]
    endpoints: ["https://elasticsearch.example.com:9200"]
    bulk:
      index: "stronghold-audit-%Y.%m.%d"

Example for Fluent Bit:

[INPUT]
    Name   tail
    Path   /var/log/stronghold_audit.log
    Parser json
    Tag    stronghold.audit

[OUTPUT]
    Name   forward
    Match  stronghold.audit
    Host   siem-collector.example.com
    Port   24224

Configure audit file rotation (for example, with logrotate) and send Stronghold a SIGHUP signal after rotation so that it reopens the file.

Connecting SIEM systems

Ingestion methods for common SIEM systems:

Field mapping

The entry structure is described in Audit log entry schema. Typical mapping to SIEM fields:

Practical notes:

• Sensitive strings (tokens, secret values) are hashed with HMAC-SHA256 using the audit device salt. To compare a value with a hash, use the audit hash mechanism of the same device.
• Use response entries for correlation: they contain both the request data and the result.
• To reduce volume, use filtering and field exclusion on a separate audit device that feeds the SIEM. Keep the full log on another device.
• Example events for correlation rules: repeated authentication failures (auth/*/login with error), operations on sys/audit, sys/policies, sys/auth, and root token usage (auth.policies contains root).