HashiCorp Vault — Audit & Monitoring

Vault provides comprehensive audit logging and telemetry for compliance, security monitoring, and operational visibility.

---

What’s in This Chapter?

#	Topic	Description
1	Audit Devices	File, syslog, and socket audit backends
2	Audit Log Format	Understanding audit log entries
3	Telemetry	Metrics export with StatsD, Prometheus
4	Prometheus & Grafana	Monitoring dashboards
5	Health Checks & Alerting	Automated health monitoring
6	Practice Exercises	5 hands-on exercises

---

Why Audit & Monitoring?

Requirement	Vault Feature
Compliance (SOC 2, HIPAA)	Audit logs — every request recorded
Security investigation	Who accessed what, when
Operational health	Telemetry metrics
Performance tuning	Request latency, throughput
Incident detection	Alerting on anomalies

---

Overview

┌──────────────────────────────────────────────────┐
│                   Vault Server                    │
│                                                    │
│  ┌──────────────┐  ┌──────────────────────────┐  │
│  │ Audit Devices │  │ Telemetry                │  │
│  │               │  │                          │  │
│  │ • File        │  │ • Prometheus /metrics     │  │
│  │ • Syslog      │  │ • StatsD                 │  │
│  │ • Socket      │  │ • DogStatsD              │  │
│  └──────┬───────┘  └──────────┬───────────────┘  │
│         │                      │                   │
└─────────┼──────────────────────┼───────────────────┘
          │                      │
     ┌────▼────┐          ┌──────▼──────┐
     │  SIEM   │          │ Prometheus  │
     │  ELK    │          │ Grafana     │
     │ Splunk  │          │ Datadog     │
     └─────────┘          └─────────────┘

---

Chapter Flow

Start with Audit Devices to enable audit logging.

---

Next: Audit Devices