Tutorial: Integrating Audit Logging (Splunk/Datadog)

import { AuditLogStore, AuditRecord, Logger } from '@ithena-one/mcp-governance'; // Adjust path
import axios from 'axios';
 
interface SplunkStoreConfig {
    hecUrl: string;         // e.g., https://your-splunk-instance:8088/services/collector
    hecToken: string;       // Your Splunk HEC token
    source?: string;        // Optional: HEC source field
    sourceType?: string;    // Optional: HEC sourcetype field (e.g., _json)
    index?: string;         // Optional: HEC index field
    logger?: Logger;        // Optional logger instance
}
 
export class SplunkAuditLogStore implements AuditLogStore {
    private readonly config: SplunkStoreConfig;
    private readonly logger: Logger;
 
    constructor(config: SplunkStoreConfig) {
        if (!config.hecUrl || !config.hecToken) {
            throw new Error('Splunk HEC URL and Token must be provided.');
        }
        this.config = {
            sourceType: '_json', // Default to JSON sourcetype
            ...config // Merge user config over defaults
        };
        this.logger = config.logger || console;
        this.logger.info?.('SplunkAuditLogStore configured.', { url: this.config.hecUrl, source: this.config.source, sourceType: this.config.sourceType, index: this.config.index });
    }
 
    async log(record: AuditRecord): Promise<void> {
        // Splunk HEC format: { "event": <your_event_data>, "source": ..., "sourcetype": ..., "index": ... }
        const payload = {
            event: record, // Send the whole AuditRecord as the event data
            ...(this.config.source && { source: this.config.source }),
            ...(this.config.sourceType && { sourcetype: this.config.sourceType }),
            ...(this.config.index && { index: this.config.index }),
        };
 
        try {
            await axios.post(this.config.hecUrl, payload, {
                headers: {
                    'Authorization': `Splunk ${this.config.hecToken}`,
                    'Content-Type': 'application/json',
                },
                // Optional: Add timeout, httpsAgent for self-signed certs etc.
            });
            this.logger.debug?.(`Successfully sent audit record to Splunk HEC`, { eventId: record.eventId });
        } catch (error: any) {
            // Log failure but don't throw - audit logging shouldn't break the app
            this.logger.error?.('Failed to send audit record to Splunk HEC', {
                eventId: record.eventId,
                error: error.message,
                status: error.response?.status,
                // data: error.response?.data // Be cautious logging response data
            });
        }
    }
 
    // Optional initialize/shutdown methods if needed (e.g., for batching)
    // async initialize(): Promise<void> { ... }
    // async shutdown(): Promise<void> { ... }
}

import { AuditLogStore, AuditRecord, Logger } from '@ithena-one/mcp-governance'; // Adjust path
import axios from 'axios';
 
interface DatadogStoreConfig {
    apiKey: string;         // Your Datadog API Key
    site?: string;          // Your Datadog site (e.g., 'datadoghq.com', 'datadoghq.eu'), defaults to 'datadoghq.com'
    source?: string;        // Optional: Datadog source tag (e.g., 'mcp-governance')
    service?: string;       // Optional: Datadog service tag (e.g., your app name)
    hostname?: string;      // Optional: Datadog hostname tag
    tags?: Record<string, string>; // Optional: Additional Datadog tags
    logger?: Logger;        // Optional logger instance
}
 
export class DatadogAuditLogStore implements AuditLogStore {
    private readonly config: DatadogStoreConfig;
    private readonly logger: Logger;
    private readonly apiUrl: string;
 
    constructor(config: DatadogStoreConfig) {
        if (!config.apiKey) {
            throw new Error('Datadog API Key must be provided.');
        }
        const site = config.site || 'datadoghq.com'; // Default site
        this.apiUrl = `https://http-intake.logs.${site}/api/v2/logs`;
        this.config = {
            source: 'mcp-governance', // Sensible default source
            ...config // Merge user config
        };
        this.logger = config.logger || console;
        this.logger.info?.('DatadogAuditLogStore configured.', { apiUrl: this.apiUrl, source: this.config.source, service: this.config.service });
    }
 
    async log(record: AuditRecord): Promise<void> {
        // Datadog Logs API expects an array of log entries
        // We add common Datadog attributes (ddsource, service, hostname, ddtags)
        // The original AuditRecord becomes the 'message' payload (or nested fields)
        const ddtags = [
            `eventId:${record.eventId}`,
            ...(this.config.tags ? Object.entries(this.config.tags).map(([k, v]) => `${k}:${v}`) : [])
        ].join(',');
 
        const payload = [{
            ddsource: this.config.source,
            ddtags: ddtags,
            hostname: this.config.hostname || record.serviceIdentifier || 'unknown', // Use serviceIdentifier if hostname missing
            service: this.config.service || record.serviceIdentifier || 'mcp-server', // Use serviceIdentifier if service missing
            message: JSON.stringify(record), // Send the full audit record as the message content initially
            // Alternatively, map specific AuditRecord fields to top-level Datadog attributes:
            // timestamp: record.timestamp,
            // status: record.outcome.status, // Map status for faceting
            // mcp_method: record.mcp.method,
            // user_id: typeof record.identity === 'string' ? record.identity : record.identity?.id,
            // ... other mapped fields ...
            // audit_details: record // Nest the remaining details
        }];
 
        try {
            await axios.post(this.apiUrl, payload, {
                headers: {
                    'DD-API-KEY': this.config.apiKey,
                    'Content-Type': 'application/json',
                },
                 // Optional: Add timeout etc.
            });
             this.logger.debug?.(`Successfully sent audit record to Datadog Logs API`, { eventId: record.eventId });
        } catch (error: any) {
            this.logger.error?.('Failed to send audit record to Datadog Logs API', {
                eventId: record.eventId,
                error: error.message,
                status: error.response?.status,
                // data: error.response?.data
            });
        }
    }
 
    // Optional initialize/shutdown methods if needed (e.g., for batching)
}