Audit Daily Review

PCI DSS 4.0 Req 10.4.1.1 daily-review primitive (mandatory effective 2025-03-31). Automated review of all security event logs, CHD/SAD components, critical system components, and security- function components — surfacing anomalies and exceptions for follow-up. The framework provides scheduling, query, severity classification, and notify wiring; the operator supplies the notify channel and any post-review workflow.

Adjacent regimes covered: HIPAA §164.308(a)(1)(ii)(D) (regular review of activity records), SOX §302/§404 (quarterly self- attestation), SOC 2 CC7.2 (anomaly identification and response), GDPR Art. 32 (ongoing security testing/evaluation). When posture is one of pci-dss / hipaa / sox / sox-404 / soc2, a notify callback is mandatory at create-time — the regulators all demand a follow-up channel.

Severity classification: denied / failure outcomes default to warning; auth.fail* / audit.read / csrf.bad_* / ato.* / honeytoken.tripped / breakglass.* / ddl.change.applied raise to alert; audit.tamper* / vault.aad.unseal_failed / config.drift.detected / vendor.integrity.tampered / ato.killSwitch.tripped raise to critical. Operators with richer rules pass opts.classify(event) → severity.

Audit events: audit.daily_review.completed (every run), .notified (notify fired), .notify_failed (notify threw or rejected; the review itself still completed), .scheduled, .stopped.

b.auditDailyReview.create(opts) #

{
  audit:             Object,     // b.audit instance (query / safeEmit)
  scheduler:         Object,     // b.scheduler instance; required for start()
  lookbackHours:     number,     // window size in hours (default 24)
  severityThreshold: string,     // info|notice|warning|alert|critical (default "warning")
  posture:           string,     // pci-dss | hipaa | sox-404 | soc2 | …
  cron:              string,     // POSIX 5-field expr (default "0 6 * * *")
  notify:            Function,   // async (summary) → void; required under listed postures
  classify:          Function,   // (event) → severity; default action-prefix table
  queryLimit:        number,     // max rows pulled from audit.query (default 10000)
  historyLimit:      number,     // bounded summary buffer (default 30)
  now:               Function,   // () → number; testing override
}

Build a daily-review scheduler. Returns { run, list, lastRun, schedule, start, stop, classify, posture, cron, severityThreshold, lookbackHours }. run() executes a single review window on demand; start() arms the scheduler so the review fires on the configured cron; list() returns the bounded history buffer of past summaries.

var review = b.auditDailyReview.create({
  audit:             auditInstance,
  scheduler:         schedulerInstance,
  lookbackHours:     24,
  severityThreshold: "warning",
  posture:           "pci-dss",
  cron:              "0 6 * * *",
  notify:            async function (summary) {
    if (summary.hitCount > 0) {
      // page on-call with summary.thresholdHits
    }
  },
});

// On-demand:
var summary = await review.run();
summary.totalEvents;       // → 1842
summary.bySeverity;        // → { info: 1700, warning: 120, alert: 22, critical: 0, notice: 0 }
summary.hitCount;          // → 142  (events at-or-above warning)

// Or arm the scheduler so the review fires nightly at 06:00 UTC:
await review.start();
review.lastRun();          // → most recent summary or null

Last updated 2026-08-08T16:39:49.652Z by seeder.