Add SIEM integration foundation - audit logger enhancements and config

Co-authored-by: makr-code <150588092+makr-code@users.noreply.github.com>

Author: Copilot

config/audit.yaml

@@ -0,0 +1,288 @@
+# ThemisDB Audit Logging & SIEM Integration Configuration
+# Version: 1.5.0
+# Last Updated: 2026-02-10
+#
+# This configuration file controls audit logging and SIEM (Security Information 
+# and Event Management) integration for ThemisDB, with specific support for 
+# TaskScheduler trigger and cron events.
+#
+# SECURITY NOTE: Only authorized administrators should modify this file.
+# Changes to SIEM configuration require proper authorization and audit trail.
+# Complies with GDPR Article 32 and ISO 27001 requirements.
+
+# ============================================================================
+# Core Audit Logging Settings
+# ============================================================================
+
+audit_logging:
+  # Enable/disable audit logging globally
+  enabled: true
+  
+  # Encrypt-then-sign: Encrypt audit entries and sign for tamper-proofing
+  encrypt_then_sign: true
+  
+  # Log file path (JSON Lines format)
+  log_path: "data/logs/audit.jsonl"
+  
+  # Encryption key ID for audit log encryption
+  key_id: "saga_log"
+  
+  # Hash chain for tamper-proofing (detect modifications)
+  enable_hash_chain: true
+  chain_state_file: "data/logs/audit_chain.json"
+
+# ============================================================================
+# SIEM Integration Settings
+# ============================================================================
+
+siem_integration:
+  # Enable SIEM forwarding
+  enable_siem: false
+  
+  # SIEM type: "syslog", "splunk", or "elastic"
+  # - syslog: Compatible with syslog-ng, rsyslog, and standard syslog daemons
+  # - splunk: Splunk HTTP Event Collector (HEC)
+  # - elastic: Elasticsearch direct indexing
+  siem_type: "syslog"
+  
+  # SIEM message format: "json", "cef", or "syslog"
+  # - json: Native JSON format (best for Splunk, Elastic)
+  # - cef: Common Event Format (industry standard, works with most SIEMs)
+  # - syslog: RFC 5424 syslog format (best for traditional syslog systems)
+  siem_format: "json"
+  
+  # SIEM server connection settings
+  siem_host: "localhost"
+  siem_port: 514  # Default ports: syslog=514, Splunk HEC=8088, Elastic=9200
+  
+  # Splunk-specific settings (only used when siem_type="splunk")
+  splunk:
+    # HTTP Event Collector (HEC) token
+    hec_token: ""
+    # HEC endpoint URL (e.g., "https://splunk.example.com:8088/services/collector/event")
+    hec_url: ""
+    # Verify SSL certificate
+    verify_ssl: true
+  
+  # Elasticsearch-specific settings (only used when siem_type="elastic")
+  elasticsearch:
+    # Index name for audit logs
+    index: "themisdb-audit"
+    # Index rotation pattern: "daily", "weekly", "monthly"
+    index_rotation: "daily"
+    # Authentication
+    username: ""
+    password: ""
+    # API key (alternative to username/password)
+    api_key: ""
+
+# ============================================================================
+# Task Scheduler Audit Settings
+# ============================================================================
+
+task_scheduler_audit:
+  # Enable audit logging for task scheduler events
+  enabled: true
+  
+  # Log all task registrations
+  log_task_registration: true
+  
+  # Log all task executions (both success and failure)
+  log_task_execution: true
+  
+  # Log cron trigger activations
+  log_cron_triggers: true
+  
+  # Log CDC event trigger activations
+  log_cdc_triggers: true
+  
+  # Log manual task executions
+  log_manual_executions: true
+  
+  # Include resource consumption metrics in audit logs
+  # (execution time, memory usage, CPU usage)
+  include_resource_metrics: true
+  
+  # Fields included in task scheduler audit events:
+  # - timestamp: ISO 8601 timestamp
+  # - event_type: Type of event (TASK_REGISTERED, TASK_EXECUTED_SUCCESS, etc.)
+  # - task_id: Unique task identifier
+  # - task_name: Human-readable task name
+  # - user_id: User or service account that triggered the event
+  # - source_ip: Source IP address (if available)
+  # - trigger_type: CRON, CDC_EVENT, MANUAL, etc.
+  # - cron_expression: Cron expression (for cron triggers)
+  # - execution_time_ms: Task execution time in milliseconds
+  # - success: Boolean indicating success or failure
+  # - error_message: Error message (on failure)
+  # - resource_usage: Resource consumption metrics
+  # - anomaly_score: Anomaly detection score (0.0 = normal, >2.0 = anomalous)
+
+# ============================================================================
+# Anomaly Detection Settings
+# ============================================================================
+
+anomaly_detection:
+  # Enable anomaly detection for task scheduler events
+  enabled: true
+  
+  # Anomaly detection threshold (standard deviations from baseline)
+  # Values > threshold are considered anomalous
+  # Recommended: 2.0 (95% confidence) or 3.0 (99.7% confidence)
+  threshold: 2.0
+  
+  # Minimum number of executions before anomaly detection is active
+  # Need baseline data before detecting anomalies
+  min_baseline_samples: 10
+  
+  # Anomaly detection dimensions
+  dimensions:
+    # Detect tasks running longer than expected
+    execution_time: true
+    
+    # Detect tasks running more/less frequently than expected
+    execution_frequency: true
+    
+    # Detect tasks running at unusual times
+    execution_timing: true
+    
+    # Detect tasks consuming excessive resources
+    resource_usage: true
+  
+  # Actions on anomaly detection
+  actions:
+    # Log anomaly event (SecurityEventType::TASK_ANOMALY_DETECTED)
+    log_event: true
+    
+    # Disable task automatically if anomaly detected
+    auto_disable_task: false
+    
+    # Send high-priority SIEM alert
+    send_siem_alert: true
+
+# ============================================================================
+# Compliance Settings
+# ============================================================================
+
+compliance:
+  # GDPR compliance settings
+  gdpr:
+    # Enable GDPR compliance mode
+    enabled: true
+    
+    # Pseudonymize user identifiers in audit logs
+    pseudonymize_users: false
+    
+    # Data retention period (days) - GDPR Article 5(1)(e)
+    retention_days: 365
+    
+    # Automatically archive logs older than retention period
+    auto_archive: true
+    archive_path: "data/logs/archive/audit-{year}-{month}.jsonl.gz"
+  
+  # ISO 27001 compliance settings
+  iso27001:
+    # Enable ISO 27001 compliance mode
+    enabled: true
+    
+    # Log access controls and authorization decisions
+    log_access_controls: true
+    
+    # Require cryptographic protection of audit logs
+    require_encryption: true
+    
+    # Require tamper-evident audit logs (hash chain)
+    require_tamper_evidence: true
+
+# ============================================================================
+# Authorization & Access Control
+# ============================================================================
+
+authorization:
+  # Roles allowed to modify SIEM configuration
+  # Only users with these roles can change audit/SIEM settings
+  siem_config_roles:
+    - "system_admin"
+    - "security_admin"
+  
+  # Roles allowed to view audit logs
+  audit_view_roles:
+    - "system_admin"
+    - "security_admin"
+    - "compliance_officer"
+    - "auditor"
+  
+  # Roles allowed to export audit logs
+  audit_export_roles:
+    - "system_admin"
+    - "security_admin"
+    - "compliance_officer"
+  
+  # Require MFA for sensitive audit operations
+  require_mfa:
+    siem_config_changes: true
+    audit_log_export: true
+    audit_log_deletion: true
+
+# ============================================================================
+# Example SIEM Integration Scenarios
+# ============================================================================
+
+# Example 1: Splunk Integration
+# ------------------------------
+# siem_integration:
+#   enable_siem: true
+#   siem_type: "splunk"
+#   siem_format: "json"
+#   splunk:
+#     hec_token: "your-splunk-hec-token"
+#     hec_url: "https://splunk.example.com:8088/services/collector/event"
+#     verify_ssl: true
+
+# Example 2: Syslog-ng Integration with CEF Format
+# -------------------------------------------------
+# siem_integration:
+#   enable_siem: true
+#   siem_type: "syslog"
+#   siem_format: "cef"
+#   siem_host: "syslog.example.com"
+#   siem_port: 514
+
+# Example 3: Elasticsearch/ELK Stack Integration
+# -----------------------------------------------
+# siem_integration:
+#   enable_siem: true
+#   siem_type: "elastic"
+#   siem_format: "json"
+#   siem_host: "elasticsearch.example.com"
+#   siem_port: 9200
+#   elasticsearch:
+#     index: "themisdb-audit"
+#     index_rotation: "daily"
+#     username: "themisdb"
+#     password: "your-password"
+
+# ============================================================================
+# Performance & Operational Settings
+# ============================================================================
+
+operational:
+  # Buffer size for batch audit logging (entries)
+  buffer_size: 100
+  
+  # Flush interval (seconds) - write buffered logs to disk
+  flush_interval: 10
+  
+  # Maximum log file size (MB) before rotation
+  max_log_file_size_mb: 100
+  
+  # Number of rotated log files to keep
+  max_rotated_files: 10
+  
+  # Async SIEM forwarding (don't block on SIEM failures)
+  async_siem_forwarding: true
+  
+  # Retry failed SIEM forwards
+  retry_siem_failures: true
+  max_retry_attempts: 3
+  retry_delay_seconds: 30

include/utils/audit_logger.h

@@ -112,6 +112,21 @@ enum class SecurityEventType {
     BACKUP_CREATED,
     RESTORE_COMPLETED,
 
+    // Task Scheduler Events (SIEM Integration)
+    TASK_REGISTERED,
+    TASK_UNREGISTERED,
+    TASK_ENABLED,
+    TASK_DISABLED,
+    TASK_UPDATED,
+    TASK_EXECUTED_SUCCESS,
+    TASK_EXECUTED_FAILURE,
+    TASK_CRON_TRIGGERED,
+    TASK_CDC_TRIGGERED,
+    TASK_MANUAL_TRIGGERED,
+    TASK_TIMEOUT,
+    TASK_RESOURCE_LIMIT_EXCEEDED,
+    TASK_ANOMALY_DETECTED,
+    
     // Generic
     CUSTOM_EVENT
 };
@@ -128,10 +143,17 @@ struct AuditLoggerConfig {
 
     // SIEM integration
     bool enable_siem = false;
-    std::string siem_type = "syslog"; // "syslog" or "splunk"
+    std::string siem_type = "syslog"; // "syslog", "splunk", or "elastic"
+    std::string siem_format = "json";  // "json", "cef", or "syslog"
     std::string siem_host = "localhost";
-    uint16_t siem_port = 514; // syslog default
+    uint16_t siem_port = 514; // syslog default (514), Splunk HEC (8088), Elastic (9200)
     std::string splunk_token; // Splunk HEC token
+    std::string elastic_index = "themisdb-audit"; // Elasticsearch index
+    
+    // Task Scheduler SIEM settings
+    bool enable_task_scheduler_audit = true;
+    bool enable_anomaly_detection = true;
+    double anomaly_threshold = 2.0; // Standard deviations from baseline
 };
 
 // Minimal Audit Logger supporting Encrypt-then-Sign batches (single-entry for now)
@@ -213,6 +235,33 @@ class AuditLogger {
      * @brief Get the configured log file path
      */
     std::string getLogPath() const { return cfg_.log_path; }
+    
+    /**
+     * @brief Log a task scheduler event with resource metrics and anomaly detection
+     * @param event_type Task scheduler event type
+     * @param task_id Task identifier
+     * @param user_id User/service account executing the task
+     * @param details Event details including resource consumption and metrics
+     */
+    void logTaskSchedulerEvent(
+        SecurityEventType event_type,
+        const std::string& task_id,
+        const std::string& user_id,
+        const nlohmann::json& details = {}
+    );
+    
+    /**
+     * @brief Calculate anomaly score for a task execution
+     * @param task_id Task identifier
+     * @param execution_time_ms Execution time in milliseconds
+     * @param resource_usage Resource consumption metrics
+     * @return Anomaly score (0.0 = normal, >2.0 = anomalous)
+     */
+    double calculateAnomalyScore(
+        const std::string& task_id,
+        double execution_time_ms,
+        const nlohmann::json& resource_usage
+    );
 
 private:
     std::shared_ptr<themis::FieldEncryption> enc_;
@@ -226,6 +275,17 @@ class AuditLogger {
     uint64_t entry_count_ = 0;
     std::chrono::system_clock::time_point last_timestamp_;
     mutable std::mutex chain_mu_;
+    
+    // Task scheduler baseline metrics for anomaly detection
+    struct TaskBaseline {
+        double avg_execution_time_ms = 0.0;
+        double stddev_execution_time_ms = 0.0;
+        size_t execution_count = 0;
+        std::chrono::system_clock::time_point last_execution;
+        double avg_frequency_seconds = 0.0; // Average time between executions
+    };
+    std::map<std::string, TaskBaseline> task_baselines_;
+    mutable std::mutex baselines_mu_;
 
     static std::vector<uint8_t> sha256(const std::vector<uint8_t>& data);
     void appendJsonLine(const nlohmann::json& j);
@@ -234,6 +294,15 @@ class AuditLogger {
     void saveChainState();
     std::string computeEntryHash(const nlohmann::json& entry) const;
     static std::string securityEventTypeToString(SecurityEventType type);
+    
+    // SIEM format converters
+    std::string formatAsJson(const nlohmann::json& event) const;
+    std::string formatAsCef(const nlohmann::json& event, SecurityEventType event_type) const;
+    std::string formatAsSyslog(const nlohmann::json& event, SecurityEventType event_type) const;
+    
+    // Anomaly detection helpers
+    void updateTaskBaseline(const std::string& task_id, double execution_time_ms);
+    double calculateZScore(double value, double mean, double stddev) const;
 };
 
 } // namespace utils