Skip to content

Audit Export (SIEM Forwarding)

Professional edition can forward selected Audit events to external systems:

  • Generic HTTPS Webhook
  • Splunk HTTP Event Collector (HEC)
  • Syslog over TCP or TCP+TLS (RFC 5424)

Microsoft Sentinel is supported by composition (Webhook → Logic App / Function, or Syslog → Azure Monitor Agent), not via a separate Azure-native client in this release.

Open Administration → Audit Export (/admin/audit-export.php). Requires Professional edition and a platform administrator. Menu visibility is not sufficient — every API enforces edition and admin checks on the server.

This feature is not the Auditing page CSV download (GET /api/v1/admin/audit/export). Audit Export is continuous external forwarding.

Architecture

Application Activity
        ↓
Existing Audit Pipeline
        ↓
audit_log   (authoritative + sanitized)
        ↓
Audit Export Worker
        ↓
Per-destination cursor
        ↓
Webhook | Splunk HEC | Syslog

Audit remains the source of truth. Audit Export only delivers already-written events. A failed destination never blocks login, report execution, API requests, or local Audit recording.

v1 assumes a single active Report Server worker against the shared database. Multi-node HA locking is intentionally deferred.

Delivery semantics

Topic Behavior
Guarantee At-least-once
Deduplication Stable Audit event_id (UUID)
Duplicates Possible if the remote accepts an event but the response fails before the cursor advances
Retry Bounded exponential backoff per destination (about 1s … 5 minutes)
Delivery window 7 days (default). Older undelivered events are skipped; the cursor advances; destination health shows a warning
Local retention Unchanged (default 90 days). SIEM outages do not delay Audit purge

Filtered-out events advance the cursor without delivery. Changing a filter applies prospectively from the current cursor (no automatic historical replay).

Default event filter

New destinations default to Security + Administration, which includes authentication, security, governance, content administration, and datasource administration.

High-volume Usage Analytics style traffic is excluded by default:

  • system / api_request
  • ordinary report view / execute / export
  • dashboard / view opens

Presets:

Preset Meaning
security_admin Security + Administration (default)
all All Audit events
custom Category / action / status / object_type lists

Canonical JSON

Exported payloads use schema version 1:

{
  "schema_version": 1,
  "event_id": "uuid",
  "timestamp": "2026-08-11T19:00:00.000Z",
  "product": "acugis_report_server",
  "category": "governance",
  "action": "update",
  "status": "success",
  "user": { "id": 123, "username": "alice@example.com" },
  "object": { "type": "report", "id": "sales-summary", "name": "Sales Summary" },
  "client": { "ip": "192.0.2.1", "user_agent": "…" },
  "duration_ms": 842,
  "details": {}
}

Required fields: schema_version, event_id, timestamp, product, category, action, status. Timestamps are RFC 3339 UTC. Field names are snake_case. Payloads reuse the sanitized Audit representation (no second event store).

Destinations

Webhook

  • HTTPS POST, Content-Type: application/json
  • Canonical JSON body
  • Optional Bearer token
  • TLS verification enabled (no casual skip-verify option)

Splunk HEC

  • HTTPS POST to the HEC URL
  • Authorization: Splunk <token>
  • Canonical event wrapped in a HEC envelope (event, time, optional index / source / sourcetype)
  • Keep event_id inside the event for correlation / dedup

Syslog

  • RFC 5424 over TCP or TCP+TLS
  • JSON message body
  • APP-NAME acugis-jrs
  • UDP and RFC 3164 are not implemented in v1

Microsoft Sentinel

Supported approaches:

  1. AcuGIS → Syslog → Azure Monitor Agent / Sentinel
  2. AcuGIS → Webhook → Logic App or Azure Function → Sentinel

Azure AD app authentication and Log Analytics ingestion APIs are not implemented here.

Secrets

Destination secrets (Bearer token, HEC token) follow the same mask/replace pattern as OIDC:

  • GET returns secret_set and secret_masked only
  • Update with blank secret and replace_secret=false keeps the existing secret
  • Secrets never appear in Audit details or ordinary API responses

Destination health

Health Meaning
Healthy Enabled and delivering without recent failures
Warning Recent failures or events skipped after the 7-day window
Failing Repeated consecutive delivery failures
Disabled Administrator disabled the destination

Administrators can Test Connection (synthetic outbound event). Delivery success/failure for the worker is recorded in destination health and logs — not as a flood of Audit events (avoids recursive export loops).

Configuration changes (create / update / delete / test) are audited under category security with object type audit_export_destination.

Administrator APIs

All require Professional + platform admin:

Method Path
GET /api/v1/admin/audit-export/destinations
POST /api/v1/admin/audit-export/destinations
GET /api/v1/admin/audit-export/destinations/{id}
PUT /api/v1/admin/audit-export/destinations/{id}
DELETE /api/v1/admin/audit-export/destinations/{id}
POST /api/v1/admin/audit-export/destinations/{id}/test
GET /api/v1/admin/audit-export/status

Schema: database/migrations/015_audit_export.sql (also ensured at startup).

Troubleshooting

Symptom Check
Community 403 Professional package without a valid license. Activate a Report Server Professional license. ACUGIS_EDITION does not grant this feature. The Open Source package does not register these routes (404).
Destination failing URL/host reachability, TLS certs, token validity, firewall
Warning about 7-day window Destination was down longer than the delivery window; local Audit still retained
No events arriving Filter preset too narrow; destination disabled; worker not started (check logs for audit export ready)
Duplicate events Expected for at-least-once; dedupe on event_id

See also Auditing for the local Audit trail and retention.