Deprecated: We are working on a new Audit Logs project that will replace this proof-of-concept. Stay tuned for more details.

Hermes

Audit logs service [Audit logs in a box from BoxyHQ]

A grade 36 Bureaucrat just like Hermes Conrad. Audit logs matters that only a true bureaucrat can handle properly.

Source code visualizer

CodeSee codebase visualizer

Run

** This project is still in beta, please get in touch if you'd like to use it in production. There are more backends being supported **

• You'll need to first configure and run Loki v1.5.0

• Then build and run hermes (you might need to modify the config). Docker image, Compose yaml and Kubernetes yaml will be coming soon.

• Hermes currently has 2 APIs available.

  • POST /ingest: This endpoint ingests an array of audit logs and stores them in Loki. It needs an Authorization header containing the Api-Key. The body is an array of audit logs
  • POST /query: This endpoint queries audit logs. The body contains the query (0 or more indexes as key-values), start and end (RFC3339).

POST /ingest

curl --location --request POST 'http://localhost:8080/ingest' \
--header 'Content-Type: application/json' \
--header 'Authorization: Api-Key abcdef' \
--data-raw '[
  {
      "actor": "deepak",
      "actor_type": "user",
      "group": "boxyhq",
      "where": "127.0.0.1",
      "where_type": "ip",
      "when": "2021-05-18T20:53:39+01:00",
      "target": "user.login",
      "target_id": "target_id",
      "action": "login",
      "action_type": "U",
      "name": "user.login",
      "description": "This is a login event",
      "metadata": {
          "foo": "bar",
          "hey": "you"
      }
  }
]'

POST /query

curl --location --request POST 'http://localhost:8080/query' \
--header 'Content-Type: application/json' \
--header 'Authorization: Api-Key abcdef' \
--data-raw '{
    "query": {
    },
    "start": "2021-05-18T20:51:39+01:00",
    "end": "2021-05-18T20:56:39+01:00"
}
'