Аудит и логирование

curl "https://api.internal:8080/v1/audit/logs?limit=100&sort=desc" \
  -H "Authorization: Bearer $API_KEY" \
  -H "X-Tenant-ID: bank_retail"

curl "https://api.internal:8080/v1/audit/logs?user_id=user_123&action=chat.completion&start_time=2024-01-01T00:00:00Z" \
  -H "Authorization: Bearer $API_KEY"

from coren import CorenClient
from datetime import datetime, timedelta

client = CorenClient(base_url="https://api.internal:8080")

# Запрос логов за последние 24 часа
logs = client.audit.logs.list(
    start_time=datetime.now() - timedelta(days=1),
    end_time=datetime.now(),
    action="chat.completion",
    limit=100,
    include_request_body=False,  # Не включать тела запросов (PII)
    include_response_body=False
)

for log in logs:
    print(f"{log.timestamp} | {log.user_id} | {log.action} | {log.status_code}")
    print(f"  IP: {log.ip_address}, Model: {log.metadata.get('model')}")
    print(f"  Tokens: {log.metadata.get('total_tokens')}")

# Поиск по конкретному запросу
log_entry = client.audit.logs.get("log_abc123def456")
print(f"Request ID: {log_entry.request_id}")
print(f"Duration: {log_entry.duration_ms}ms")

{
  "id": "log_abc123def456",
  "timestamp": "2024-01-30T12:34:56.789Z",
  "tenant_id": "bank_retail",
  "user_id": "user_ivan_petrov",
  "service_account": null,
  "action": "chat.completion",
  "resource_type": "inference",
  "resource_id": "chatcmpl_xyz789",
  "method": "POST",
  "path": "/v1/chat/completions",
  "ip_address": "10.0.15.42",
  "user_agent": "coren-python/1.2.0",
  "request_id": "req_abc123",
  "trace_id": "trace_def456",
  "span_id": "span_ghi789",
  "status_code": 200,
  "duration_ms": 1234,
  "request_summary": {
    "model": "llama-3-70b-chat",
    "message_count": 3,
    "has_system_prompt": true,
    "stream": false
  },
  "response_summary": {
    "tokens_prompt": 45,
    "tokens_completion": 150,
    "tokens_total": 195,
    "finish_reason": "stop"
  },
  "policy_checks": [
    {
      "policy_id": "pii-detection",
      "result": "pass",
      "duration_ms": 12
    },
    {
      "policy_id": "content-filter",
      "result": "pass",
      "duration_ms": 8
    }
  ],
  "metadata": {
    "environment": "production",
    "region": "ru-central",
    "provider": "vllm",
    "model_version": "v1.2.0"
  },
  "tags": ["inference", "llm", "production"],
  "fingerprint": "sha256:abc123..."
}

# Создание правила оповещения
alert_rule = client.audit.alerts.create(
    name="failed-auth-spike",
    description="Всплеск неудачных попыток аутентификации",
    query={
        "action": "auth.failed",
        "time_window": "5m"
    },
    condition={
        "type": "threshold",
        "operator": "gt",
        "value": 10
    },
    severity="high",
    channels=[
        {
            "type": "email",
            "recipients": ["security@bank.internal"]
        },
        {
            "type": "slack",
            "webhook_url": "https://hooks.slack.com/...",
            "channel": "#security-alerts"
        },
        {
            "type": "pagerduty",
            "integration_key": "..."
        }
    ],
    actions=[
        {
            "type": "block_ip",
            "duration_minutes": 30
        }
    ]
)

# Пример оповещения при обнаружении PII
pii_alert = client.audit.alerts.create(
    name="pii-in-prompt",
    description="Обнаружены персональные данные в запросе",
    query={
        "action": "policy.violation",
        "metadata.policy_id": "pii-detection"
    },
    condition={"type": "any"},
    severity="critical",
    channels=[
        {"type": "email", "recipients": ["dpo@bank.internal"]}
    ]
)

# Экспорт в S3-совместимое хранилище (MinIO)
export_job = client.audit.export(
    start_time=datetime(2024, 1, 1),
    end_time=datetime(2024, 1, 31),
    destination={
        "type": "s3",
        "bucket": "audit-archive",
        "prefix": "coren/2024/01/",
        "endpoint": "https://minio.internal:9000"
    },
    format="parquet",  # или "json", "csv"
    compression="gzip",
    partition_by=["date", "action"]
)

print(f"Export job: {export_job.id}")
print(f"Status: {export_job.status}")

# Стриминг в Kafka для SIEM интеграции
client.audit.stream.configure(
    name="siem-integration",
    destination={
        "type": "kafka",
        "brokers": ["kafka-1.internal:9092", "kafka-2.internal:9092"],
        "topic": "security-audit-logs",
        "security_protocol": "SASL_SSL"
    },
    filter={
        "actions": ["auth.*", "policy.violation", "secrets.*"],
        "severity": ["warning", "error", "critical"]
    },
    format="json"
)

# Интеграция с ELK Stack
client.audit.stream.configure(
    name="elk-integration",
    destination={
        "type": "elasticsearch",
        "hosts": ["https://es.internal:9200"],
        "index_pattern": "coren-audit-{date}"
    },
    filter={"all": True}
)