feat(audit-log-stream): cribl support

backend/src/ee/routes/v1/audit-log-stream-routers/audit-log-stream-router.ts

@@ -1,5 +1,9 @@
 import { z } from "zod";
 
+import {
+  CriblProviderListItemSchema,
+  SanitizedCriblProviderSchema
+} from "@app/ee/services/audit-log-stream/cribl/cribl-provider-schemas";
 import {
   CustomProviderListItemSchema,
   SanitizedCustomProviderSchema
@@ -19,13 +23,15 @@ import { AuthMode } from "@app/services/auth/auth-type";
 const SanitizedAuditLogStreamSchema = z.union([
   SanitizedCustomProviderSchema,
   SanitizedDatadogProviderSchema,
-  SanitizedSplunkProviderSchema
+  SanitizedSplunkProviderSchema,
+  SanitizedCriblProviderSchema
 ]);
 
 const ProviderOptionsSchema = z.discriminatedUnion("provider", [
   CustomProviderListItemSchema,
   DatadogProviderListItemSchema,
-  SplunkProviderListItemSchema
+  SplunkProviderListItemSchema,
+  CriblProviderListItemSchema
 ]);
 
 export const registerAuditLogStreamRouter = async (server: FastifyZodProvider) => {

backend/src/ee/routes/v1/audit-log-stream-routers/index.ts

@@ -1,4 +1,9 @@
 import { LogProvider } from "@app/ee/services/audit-log-stream/audit-log-stream-enums";
+import {
+  CreateCriblProviderLogStreamSchema,
+  SanitizedCriblProviderSchema,
+  UpdateCriblProviderLogStreamSchema
+} from "@app/ee/services/audit-log-stream/cribl/cribl-provider-schemas";
 import {
   CreateCustomProviderLogStreamSchema,
   SanitizedCustomProviderSchema,
@@ -47,5 +52,14 @@ export const AUDIT_LOG_STREAM_REGISTER_ROUTER_MAP: Record<LogProvider, (server:
         createSchema: CreateSplunkProviderLogStreamSchema,
         updateSchema: UpdateSplunkProviderLogStreamSchema
       });
+    },
+    [LogProvider.Cribl]: async (server: FastifyZodProvider) => {
+      registerAuditLogStreamEndpoints({
+        server,
+        provider: LogProvider.Cribl,
+        sanitizedResponseSchema: SanitizedCriblProviderSchema,
+        createSchema: CreateCriblProviderLogStreamSchema,
+        updateSchema: UpdateCriblProviderLogStreamSchema
+      });
     }
   };

backend/src/ee/services/audit-log-stream/audit-log-stream-enums.ts

@@ -1,5 +1,6 @@
 export enum LogProvider {
+  Cribl = "cribl",
+  Custom = "custom",
   Datadog = "datadog",
-  Splunk = "splunk",
-  Custom = "custom"
+  Splunk = "splunk"
 }

backend/src/ee/services/audit-log-stream/audit-log-stream-factory.ts

@@ -1,5 +1,6 @@
 import { LogProvider } from "./audit-log-stream-enums";
 import { TAuditLogStreamCredentials, TLogStreamFactory } from "./audit-log-stream-types";
+import { CriblProviderFactory } from "./cribl/cribl-provider-factory";
 import { CustomProviderFactory } from "./custom/custom-provider-factory";
 import { DatadogProviderFactory } from "./datadog/datadog-provider-factory";
 import { SplunkProviderFactory } from "./splunk/splunk-provider-factory";
@@ -9,5 +10,6 @@ type TLogStreamFactoryImplementation = TLogStreamFactory<TAuditLogStreamCredenti
 export const LOG_STREAM_FACTORY_MAP: Record<LogProvider, TLogStreamFactoryImplementation> = {
   [LogProvider.Datadog]: DatadogProviderFactory as TLogStreamFactoryImplementation,
   [LogProvider.Splunk]: SplunkProviderFactory as TLogStreamFactoryImplementation,
-  [LogProvider.Custom]: CustomProviderFactory as TLogStreamFactoryImplementation
+  [LogProvider.Custom]: CustomProviderFactory as TLogStreamFactoryImplementation,
+  [LogProvider.Cribl]: CriblProviderFactory as TLogStreamFactoryImplementation
 };

backend/src/ee/services/audit-log-stream/audit-log-stream-fns.ts

@@ -3,14 +3,18 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import { TAuditLogStream, TAuditLogStreamCredentials } from "./audit-log-stream-types";
+import { getCriblProviderListItem } from "./cribl/cribl-provider-fns";
 import { getCustomProviderListItem } from "./custom/custom-provider-fns";
 import { getDatadogProviderListItem } from "./datadog/datadog-provider-fns";
 import { getSplunkProviderListItem } from "./splunk/splunk-provider-fns";
 
 export const listProviderOptions = () => {
-  return [getDatadogProviderListItem(), getSplunkProviderListItem(), getCustomProviderListItem()].sort((a, b) =>
-    a.name.localeCompare(b.name)
-  );
+  return [
+    getDatadogProviderListItem(),
+    getSplunkProviderListItem(),
+    getCustomProviderListItem(),
+    getCriblProviderListItem()
+  ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
 export const encryptLogStreamCredentials = async ({

backend/src/ee/services/audit-log-stream/audit-log-stream-types.ts

@@ -1,16 +1,18 @@
 import { TAuditLogs } from "@app/db/schemas";
 
 import { LogProvider } from "./audit-log-stream-enums";
+import { TCriblProvider, TCriblProviderCredentials } from "./cribl/cribl-provider-types";
 import { TCustomProvider, TCustomProviderCredentials } from "./custom/custom-provider-types";
 import { TDatadogProvider, TDatadogProviderCredentials } from "./datadog/datadog-provider-types";
 import { TSplunkProvider, TSplunkProviderCredentials } from "./splunk/splunk-provider-types";
 
-export type TAuditLogStream = TDatadogProvider | TSplunkProvider | TCustomProvider;
+export type TAuditLogStream = TDatadogProvider | TSplunkProvider | TCustomProvider | TCriblProvider;
 
 export type TAuditLogStreamCredentials =
   | TDatadogProviderCredentials
   | TSplunkProviderCredentials
-  | TCustomProviderCredentials;
+  | TCustomProviderCredentials
+  | TCriblProviderCredentials;
 
 export type TCreateAuditLogStreamDTO = {
   provider: LogProvider;

backend/src/ee/services/audit-log-stream/cribl/cribl-provider-factory.ts

@@ -0,0 +1,58 @@
+import { RawAxiosRequestHeaders } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
+
+import { AUDIT_LOG_STREAM_TIMEOUT } from "../../audit-log/audit-log-queue";
+import { TLogStreamFactoryStreamLog, TLogStreamFactoryValidateCredentials } from "../audit-log-stream-types";
+import { TCriblProviderCredentials } from "./cribl-provider-types";
+
+export const CriblProviderFactory = () => {
+  const validateCredentials: TLogStreamFactoryValidateCredentials<TCriblProviderCredentials> = async ({
+    credentials
+  }) => {
+    const { url, token } = credentials;
+
+    await blockLocalAndPrivateIpAddresses(url);
+
+    const streamHeaders: RawAxiosRequestHeaders = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    };
+
+    await request
+      .post(url, JSON.stringify({ ping: "ok" }), {
+        headers: streamHeaders,
+        timeout: AUDIT_LOG_STREAM_TIMEOUT,
+        signal: AbortSignal.timeout(AUDIT_LOG_STREAM_TIMEOUT)
+      })
+      .catch((err) => {
+        throw new BadRequestError({ message: `Failed to connect with Cribl: ${(err as Error)?.message}` });
+      });
+
+    return credentials;
+  };
+
+  const streamLog: TLogStreamFactoryStreamLog<TCriblProviderCredentials> = async ({ credentials, auditLog }) => {
+    const { url, token } = credentials;
+
+    await blockLocalAndPrivateIpAddresses(url);
+
+    const streamHeaders: RawAxiosRequestHeaders = {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    };
+
+    await request.post(url, JSON.stringify(auditLog), {
+      headers: streamHeaders,
+      timeout: AUDIT_LOG_STREAM_TIMEOUT,
+      signal: AbortSignal.timeout(AUDIT_LOG_STREAM_TIMEOUT)
+    });
+  };
+
+  return {
+    validateCredentials,
+    streamLog
+  };
+};

backend/src/ee/services/audit-log-stream/cribl/cribl-provider-fns.ts

@@ -0,0 +1,8 @@
+import { LogProvider } from "../audit-log-stream-enums";
+
+export const getCriblProviderListItem = () => {
+  return {
+    name: "Cribl" as const,
+    provider: LogProvider.Cribl as const
+  };
+};

backend/src/ee/services/audit-log-stream/cribl/cribl-provider-schemas.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+
+import { LogProvider } from "../audit-log-stream-enums";
+import { BaseProviderSchema } from "../audit-log-stream-schemas";
+
+export const CriblProviderCredentialsSchema = z.object({
+  url: z.string().url().trim().min(1).max(255),
+  token: z.string().trim().min(21).max(255)
+});
+
+const BaseCriblProviderSchema = BaseProviderSchema.extend({ provider: z.literal(LogProvider.Cribl) });
+
+export const CriblProviderSchema = BaseCriblProviderSchema.extend({
+  credentials: CriblProviderCredentialsSchema
+});
+
+export const SanitizedCriblProviderSchema = BaseCriblProviderSchema.extend({
+  credentials: CriblProviderCredentialsSchema.pick({
+    url: true
+  })
+});
+
+export const CriblProviderListItemSchema = z.object({
+  name: z.literal("Cribl"),
+  provider: z.literal(LogProvider.Cribl)
+});
+
+export const CreateCriblProviderLogStreamSchema = z.object({
+  credentials: CriblProviderCredentialsSchema
+});
+
+export const UpdateCriblProviderLogStreamSchema = z.object({
+  credentials: CriblProviderCredentialsSchema
+});

backend/src/ee/services/audit-log-stream/cribl/cribl-provider-types.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+
+import { CriblProviderCredentialsSchema, CriblProviderSchema } from "./cribl-provider-schemas";
+
+export type TCriblProvider = z.infer<typeof CriblProviderSchema>;
+
+export type TCriblProviderCredentials = z.infer<typeof CriblProviderCredentialsSchema>;

backend/src/keystore/keystore.ts

@@ -1,9 +1,10 @@
+import { Cluster, Redis } from "ioredis";
+
 import { buildRedisFromConfig, TRedisConfigKeys } from "@app/lib/config/redis";
 import { pgAdvisoryLockHashText } from "@app/lib/crypto/hashtext";
 import { applyJitter } from "@app/lib/dates";
 import { delay as delayMs } from "@app/lib/delay";
 import { ExecutionResult, Redlock, Settings } from "@app/lib/red-lock";
-import { Redis, Cluster } from "ioredis";
 
 export const PgSqlLock = {
   BootUpMigration: 2023,