SIEM and audit log for compliance

The steps, in order

1. 1

   Step 1

   SIEM is disabled by default. You enable it explicitly, with destination, protocol and format — there is no background sending you did not ask for.

2. 2

   Step 2

   The queue is bounded at 512 events. If the destination does not respond you lose old events, not process memory.

3. 3

   Step 3

   The audit log is append-only: it cannot be edited or deleted from the application. For compliance, export it periodically.

4. 4

   Step 4

   Roles are admin, analyst and viewer. Tokens are stored as SHA-256, never in clear text, and passwords use scrypt with a salt.