PR Custody

feat(audit): SIEM audit foundations — event taxonomy, compliance fields, TTL bump

@sujayjayjaychecks n/achecks…feat/siem-audit-foundations → main14 files · +318 −2updated 3w ago

▸Description · 2 noise

Foundational audit infrastructure for SIEM/compliance readiness (PRD-01):

Dot-namespaced event taxonomy (packages/types/src/audit-action.ts): 70+ canonical audit actions (team.created, member.invited, tool.executed, etc.) with legacy event-type mapping for backwards-compatible reads of existing ClickHouse rows
Compliance fields on ClickHouse tables: actor_email, actor_ip, actor_roles, session_id added to both tool_call_events and portal_audit_events — required for SIEM integrations (Datadog, Splunk, Sentinel)
Full audit payload chain wired: IP extraction from X-Forwarded-For, session ID from Composio session, email/roles from auth context — threaded from HTTP request through Redis queue to ClickHouse
TTL bump to 365 days: Enterprise retention requirement (was 90 days)
Meta-audit events: Admins exporting audit CSV now emit audit.log_exported event (compliance trail for who-accessed-what)

Area	Files	What
Types	`audit-action.ts`, `index.ts`, `package.json`	New `AuditAction` const + legacy mapping + barrel export
ClickHouse	`005_compliance_fields.sql`, `006_ttl_365_days.sql`, `001_*.sql`	Migration + baseline TTL update
Analytics	`tool-call-events.ts`, `portal-audit-events.ts`	Compliance fields in insert schemas + row mappers
Proxy	`audit-payload.ts`, `server-factory-runtime.ts`, `app-mcp-routes.ts`, `app-types.ts`, `audit-writers.ts`	IP/session/email/roles threaded through audit chain
Admin	`export-csv.ts`	Meta-audit event on CSV export

bunx turbo check-types passes (confirmed locally — only pre-existing @repo/internal errors)
bunx turbo lint --filter=@repo/proxy --filter=@repo/admin --filter=@repo/analytics --filter=@repo/types passes
Run ClickHouse migrations 005 and 006 on staging
Verify tool call events written to ClickHouse include actor_email, actor_ip, actor_roles, session_id
Verify CSV export emits audit.log_exported portal audit event
Verify resolveAuditAction() maps legacy event types correctly

🤖 Generated with Claude Code

▸ 2 bot/status comments hidden

@vercel[bot]3w ago

Someone is attempting to deploy this pull request to the Composio Team on Vercel.

No GitHub account was found matching the commit author email address.

To deploy this pull request, the commit author's email address needs to be associated with a GitHub account.

Learn more about how to change the commit author information.

@vercel[bot]3w ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
composio-enterprise-admin	Error		May 18, 2026 9:51pm

Project	Deployment	Actions	Updated (UTC)
composio-enterprise-internal	Skipped

loading diff…