Managed log source for Signal Sciences audit logs

[timoguin]

Add support for managing audit logs from Signal Sciences.

Considerations

Signal Sciences has two types of audit logs:

• Corp audit logs
• Site audit logs

Currently, only the site audit logs can be streamed in a useful way, via generic webhooks.

Corp audit logs, which may arguably be more useful, can only be sent to email, Microsoft Teams, or Slack. I have an open feature request (pre-Fastly acquisition) for webhook support that is several years old and seems to have gotten lost in the ether a few times, despite several follow-ups with account reps and TAMs. 😞

Tasks

• [ ] Research, planning, and design
• [ ] ECS schemas
• [ ] VRL transforms
• [ ] Docs and examples

References

• https://docs.fastly.com/signalsciences/integrations/
• Site audit log webhooks and format
• Corp audit log mailing list and format