SRS-058: Consolidated Audit Record Content
Identifier
SRS-058
Software System
- Audit Service
- All services that generate audit events
Category
- Security
- Data Integrity
Description
Each audit trail entry shall be a single, consolidated, and structured record containing a complete set of information for every logged event.
- Mandatory fields: Every audit record must contain at least the following fields:
- Actor identity: The verified identity (e.g., username, system process ID) of the actor that initiated the event.
- Actor role: The role associated with the actor at the time of the event.
- Timestamp: A precise timestamp from a trusted time source, indicating when the event occurred.
- Event type: A clear and consistent description of the type of event (e.g.,
user.login.success,data.view,security.permissions.update). - System response: The outcome or response from the system to the event (e.g.,
success,failure, HTTP status code). - Contextual data: Relevant contextual data that helps to understand the event, such as the source IP address or the user session ID.
Derived from PRS
PRS-0MC: Comprehensive secure audit trails for user interactions