# Audit Logging — Ninja Nexus

## Princip

Alle handlinger der ændrer tilstand, tilgår følsomme data, eller påvirker sikkerhed **skal logges**. Audit logs er append-only og kan ikke modificeres af admin.

---

## Hvad logges

### Identity
- Login (success/failure) med IP, device, MFA-metode
- Logout og session revoke
- Password change/reset
- MFA enrollment/removal
- Role/permission changes
- User create/update/delete

### Device Management
- Device registration/decommission
- Policy create/update/delete/assign
- Compliance status changes
- Remote wipe/lock commands
- Device trust score changes

### App Center & Deployment
- App publish/unpublish
- Install/uninstall (per device)
- Deployment job create/cancel
- App approval/denial

### Remote Support
- Session start/end
- Connect/disconnect events
- Commands executed in remote terminal
- File transfers
- Screen recording start/stop

### Administration
- Control Center login
- Configuration changes
- Tenant operations (Fase 8)
- API key create/revoke

---

## Event Format

```json
{
  "event_id": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2026-06-04T10:30:00.000Z",
  "tenant_id": "tenant-uuid",
  "actor": {
    "type": "user|admin|system|agent",
    "id": "actor-uuid",
    "email": "admin@company.dk",
    "ip": "192.168.1.100"
  },
  "action": "device.policy.assign",
  "resource": {
    "type": "policy",
    "id": "policy-uuid",
    "name": "Require BitLocker"
  },
  "target": {
    "type": "device_group",
    "id": "group-uuid",
    "name": "All Laptops"
  },
  "result": "success",
  "details": {
    "previous_version": 2,
    "new_version": 3
  },
  "checksum": "sha256-of-event-body"
}
```

---

## Opbevaring

| Egenskab | Værdi |
|----------|-------|
| Database | PostgreSQL (dedikeret audit schema) |
| Skrivemodel | Append-only (ingen UPDATE/DELETE) |
| Kryptering | At-rest encryption (TDE) |
| Default retention | 2 år |
| Max retention | 7 år (konfigurerbar) |
| Arkivering | Cold storage efter 1 år (blob) |

---

## Integritet

- Hvert event har SHA-256 checksum
- Daglig batch: hash chain over dagens events
- Ugentlig verification job
- Ved tampering-detection: alert til super admin

---

## Adgang til audit

| Rolle | Adgang |
|-------|--------|
| Super Admin | Fuld søgning og export |
| Admin | Egen organisations audit |
| Support | Read-only, seneste 30 dage |
| User | Egne login-events only |
| API/SIEM | Export via API (service token) |

---

## SIEM Integration (Fase 8)

- Export format: CEF, LEEF, eller JSON stream
- Endpoints: Splunk HEC, Azure Sentinel, Elastic
- Real-time: event bus → webhook → SIEM
- Batch: daglig export til SFTP/blob

---

*Se også: [SECURITY_MODEL.md](./SECURITY_MODEL.md) · [PERMISSION_SYSTEM.md](./PERMISSION_SYSTEM.md)*
