audit-setup

Security Audit Logging System

Action: $ARGUMENTS (default: init)

Parse $ARGUMENTS:

• init — Generate the complete audit logging system (schema, middleware, service, dashboard)
• report — Generate an audit report for a specified time period
• alerts — Configure alerting rules for suspicious activity patterns
• compliance — Generate compliance checklist and evidence for GDPR/SOC 2/HIPAA
• No argument = init

---

Step 0: Detect Project Context

echo "=== Project Type ==="
ls package.json pyproject.toml build.gradle.kts pom.xml 2>/dev/null

echo "=== Backend Language ==="
if [ -f "pyproject.toml" ] || [ -f "requirements.txt" ]; then
  echo "Python/FastAPI detected"
elif [ -f "package.json" ] && grep -q "nestjs" package.json 2>/dev/null; then
  echo "NestJS detected"
elif [ -f "build.gradle.kts" ] || [ -f "pom.xml" ]; then
  echo "Spring Boot detected"
fi

echo "=== Existing Audit/Logging ==="
grep -rn "audit\|AuditLog\|audit_log" --include="*.py" --include="*.ts" --include="*.java" . 2>/dev/null | grep -v node_modules | head -20

echo "=== Auth System ==="
find . -maxdepth 5 -path "*/auth*" -name "*.py" -o -path "*/auth*" -name "*.ts" -o -path "*/auth*" -name "*.java" 2>/dev/null | grep -v node_modules | head -10

echo "=== Database ==="
grep -rn "mysql\|mongodb\|DATABASE_URL\|MONGO" .env* 2>/dev/null | head -5

Determine:

• Backend language (Python/NestJS/Spring Boot)
• Which database to use for audit logs (MySQL for structured, MongoDB for high-volume)
• Whether auth system exists (to instrument login/logout events)

---

Step 1: Audit Event Categories

Define the complete list of auditable events:

Authentication Events (MUST audit)

Event	Severity	Data Captured
auth.login.success	INFO	user_id, IP, user_agent, method (password/oauth)
auth.login.failure	WARNING	email_attempted, IP, user_agent, failure_reason
auth.logout	INFO	user_id, IP
auth.token.refresh	INFO	user_id, IP
auth.password.change	WARNING	user_id, IP
auth.password.reset.request	WARNING	email, IP
auth.password.reset.complete	WARNING	user_id, IP
auth.2fa.enable	WARNING	user_id, IP
auth.2fa.disable	CRITICAL	user_id, IP
auth.account.lockout	CRITICAL	user_id, IP, failed_attempts