updated at 2024-09-16T08:47:22-04:00

ext/app/server/lib/HECAuditLogger.ts

@@ -0,0 +1,24 @@
+import {AuditEvent, AuditEventName} from 'app/common/AuditEvent';
+import {IAuditLogger} from 'app/server/lib/AuditLogger';
+import {HTTPAuditLogger} from 'app/server/lib/HTTPAuditLogger';
+import moment from 'moment-timezone';
+
+export class HECAuditLogger extends HTTPAuditLogger implements IAuditLogger {
+  protected toJSON<Name extends AuditEventName>({event, timestamp}: AuditEvent<Name>): string {
+    return JSON.stringify({
+      event,
+      time: toUnixTimestamp(timestamp),
+    });
+  }
+}
+
+/**
+ * Converts an ISO 8601 timestamp to a Unix timestamp.
+ *
+ * The format of the timestamp is `[seconds].[milliseconds]` (e.g. `"1725459194.123"`), as
+ * documented [here](https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/FormateventsforHTTPEventCollector#Event_metadata).
+ */
+function toUnixTimestamp(timestamp: string): string {
+  const unixMs = moment(timestamp).format('x');
+  return `${unixMs.slice(0, -3)}.${unixMs.slice(-3)}`;
+}

ext/app/server/lib/configureHECAuditLogger.ts

@@ -0,0 +1,29 @@
+import {appSettings} from 'app/server/lib/AppSettings';
+import {HECAuditLogger} from 'app/server/lib/HECAuditLogger';
+
+export function configureHECAuditLogger() {
+  const options = checkHECAuditLogger();
+  if (!options) { return undefined; }
+
+  return new HECAuditLogger(options);
+}
+
+export function checkHECAuditLogger() {
+  const settings = appSettings.section('auditLogger').section('http');
+  const endpoint = settings.flag('endpoint').readString({
+    envVar: 'GRIST_AUDIT_HTTP_ENDPOINT',
+  });
+  if (!endpoint) { return undefined; }
+
+  const payloadFormat = settings.flag('payloadFormat').readString({
+    envVar: 'GRIST_AUDIT_HTTP_PAYLOAD_FORMAT',
+  });
+  if (payloadFormat !== 'hec') { return undefined; }
+
+  const authorizationHeader = settings.flag('authorizationHeader').readString({
+    envVar: 'GRIST_AUDIT_HTTP_AUTHORIZATION_HEADER',
+    censor: true,
+  });
+
+  return {endpoint, authorizationHeader};
+}

ext/app/server/lib/create.ts

@@ -1,6 +1,8 @@
 import { Activation } from 'app/gen-server/lib/Activation';
 import { configureSendGridNotifier } from 'app/gen-server/lib/configureSendGridNotifier';
 import { checkAzureExternalStorage, configureAzureExternalStorage } from 'app/server/lib/configureAzureExternalStorage';
+import { checkGristAuditLogger, configureGristAuditLogger } from 'app/server/lib/configureGristAuditLogger';
+import { checkHECAuditLogger, configureHECAuditLogger } from 'app/server/lib/configureHECAuditLogger';
 import { checkMinIOExternalStorage, configureMinIOExternalStorage } from 'app/server/lib/configureMinIOExternalStorage';
 import { checkS3ExternalStorage, configureS3ExternalStorage } from 'app/server/lib/configureS3ExternalStorage';
 import { ICreate, makeSimpleCreator } from 'app/server/lib/ICreate';
@@ -32,6 +34,18 @@ export const makeEnterpriseCreator = () => makeSimpleCreator({
   notifier: {
     create: configureSendGridNotifier,
   },
+  auditLogger: [
+    {
+      name: 'grist',
+      check: () => checkGristAuditLogger() !== undefined,
+      create: configureGristAuditLogger,
+    },
+    {
+      name: 'hec',
+      check: () => checkHECAuditLogger() !== undefined,
+      create: configureHECAuditLogger,
+    },
+  ],
 });
 
 export const create = isRunningEnterprise() ? makeEnterpriseCreator() : makeCoreCreator();