MELTr
Home Vendors Search Download
Login
Vendors / HashiCorp / Vault / Vault enable file audit response
HashiCorp logo

Event type

Vault enable file audit response

Vault v1.18.4 published enable-file audit response profile; root policy, paired synthetic token/accessor, registry client/data digests and fresh time/UUID/port.

JSON 43 fields Generator

vault audit
Preview Sample View Schema
CLI Install
meltr templates install hashicorp

Overview

What this event covers

Independent response snapshot for sys/audit/file enable operation. Uses schema-standard registry fields plus generated vendor-specific IDs. Works with the default MELTr entity sample.yaml; example configuration: configs/hashicorp/vault/audit.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

  • ›A file audit device is enabled.

Security relevance

Informational

Frequency notes

One event/second local test rate; independent server snapshots, not repeated enables on a persistent server.

Resources

Docs and tools

Complete emitted response official Field types and conditional presence official

Generation

Configuration

Base frequency
3600 events/hour
Business hours
1.0x
Night hours
1.0x
Weekend
1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

auth
Object Optional

Required container.

Source: Required container.

Example {"accessor":"hmac-sha256:50ec8881ead7497fc5d51b80ad1819a217ebbc4b23b263e686a7a45012c4931c","client_token":"hmac-sha256:fcef3751758c51565657973f58c67959a50fff0fbf79f7e659c297257cc0ab30","display_name":"token","policies":["root"],"policy_results":{"allowed":true,"granting_policies":[{"type":""},{"name":"root","namespace_id":"root","type":"acl"}]},"token_issue_time":"2026-10-01T21:48:12.991047Z","token_policies":["root"],"token_type":"service"}
auth.accessor
String Optional

Per-event accessor: hmac-sha256: plus Faker 64 lowercase hex characters; reused in request.

Source: Per-event accessor: hmac-sha256: plus Faker 64 lowercase hex characters; reused in request.

Example hmac-sha256:50ec8881ead7497fc5d51b80ad1819a217ebbc4b23b263e686a7a45012c4931c
auth.client_token
String Optional

Per-event token: hmac-sha256: plus Faker 64 lowercase hex characters; reused in request.

Source: Per-event token: hmac-sha256: plus Faker 64 lowercase hex characters; reused in request.

Example hmac-sha256:fcef3751758c51565657973f58c67959a50fff0fbf79f7e659c297257cc0ab30
auth.display_name
String Optional

Fixed "token".

Source: Fixed "token".

Example token
auth.policies
Array Optional

Exactly 1 items.

Source: Exactly 1 items.

Example ["root"]
auth.policies[0]
String Optional

Fixed "root".

Source: Fixed "root".

Example root
auth.policy_results
Object Optional

Required container.

Source: Required container.

Example {"allowed":true,"granting_policies":[{"type":""},{"name":"root","namespace_id":"root","type":"acl"}]}
auth.policy_results.allowed
Boolean Optional

Fixed true.

Source: Fixed true.

Example true
auth.policy_results.granting_policies
Array Optional

Exactly 2 items.

Source: Exactly 2 items.

Example [{"type":""},{"name":"root","namespace_id":"root","type":"acl"}]
auth.policy_results.granting_policies[0]
Object Optional

Required container.

Source: Required container.

Example {"type":""}
auth.policy_results.granting_policies[0].type
String Optional

Fixed "".

Source: Fixed "".

auth.policy_results.granting_policies[1]
Object Optional

Required container.

Source: Required container.

Example {"name":"root","namespace_id":"root","type":"acl"}
auth.policy_results.granting_policies[1].name
String Optional

Fixed "root".

Source: Fixed "root".

Example root
auth.policy_results.granting_policies[1].namespace_id
String Optional

Fixed "root".

Source: Fixed "root".

Example root
auth.policy_results.granting_policies[1].type
String Optional

Fixed "acl".

Source: Fixed "acl".

Example acl
auth.token_policies
Array Optional

Exactly 1 items.

Source: Exactly 1 items.

Example ["root"]
auth.token_policies[0]
String Optional

Fixed "root".

Source: Fixed "root".

Example root
auth.token_issue_time
String Optional

Same clock minus 3600 seconds through iso8601_utc.

Source: Same clock minus 3600 seconds through iso8601_utc.

Example 2026-10-01T21:48:12.991047Z
auth.token_type
String Optional

Fixed "service".

Source: Fixed "service".

Example service
request
Object Optional

Required container.

Source: Required container.

Example {"client_id":"GRfjNAfCg2bI47l1sX5zdFiTEmdrkCKa20zm5YVS4iM=","client_token":"hmac-sha256:fcef3751758c51565657973f58c67959a50fff0fbf79f7e659c297257cc0ab30","client_token_accessor":"hmac-sha256:50ec8881ead7497fc5d51b80ad1819a217ebbc4b23b263e686a7a45012c4931c","data":{"description":"hmac-sha256:c5b18e26a3352dc8ed0fa104511c39b533864d33130270f9f904eb0372658d08","local":false,"options":{"file_path":"hmac-sha256:1ccac0e264b9267343c6b6b960db39af64dfebdbdc0f75453f4259dd88efa9c3"},"type":"hmac-sha256:65abaf3c64bbae2c283b165b7100e89b071d4beb4779b6700433af00c1635e73"},"id":"59b74f26-8874-4a6d-a75c-c55e67bf965c","mount_accessor":"system_53409ed3","mount_class":"secret","mount_point":"sys/","mount_running_version":"v1.18.4+builtin.vault","mount_type":"system","namespace":{"id":"root"},"operation":"update","path":"sys/audit/file","remote_address":"127.0.0.1","remote_port":62687}
request.client_id
String Optional

Selected service vault_client_id; synthetic base64-shaped 32-byte identity.

Source: Selected service vault_client_id; synthetic base64-shaped 32-byte identity.

Example GRfjNAfCg2bI47l1sX5zdFiTEmdrkCKa20zm5YVS4iM=
request.client_token
String Optional

Same token value as auth.client_token.

Source: Same token value as auth.client_token.

Example hmac-sha256:fcef3751758c51565657973f58c67959a50fff0fbf79f7e659c297257cc0ab30
request.client_token_accessor
String Optional

Same accessor value as auth.accessor.

Source: Same accessor value as auth.accessor.

Example hmac-sha256:50ec8881ead7497fc5d51b80ad1819a217ebbc4b23b263e686a7a45012c4931c
request.data
Object Optional

Required container.

Source: Required container.

Example {"description":"hmac-sha256:c5b18e26a3352dc8ed0fa104511c39b533864d33130270f9f904eb0372658d08","local":false,"options":{"file_path":"hmac-sha256:1ccac0e264b9267343c6b6b960db39af64dfebdbdc0f75453f4259dd88efa9c3"},"type":"hmac-sha256:65abaf3c64bbae2c283b165b7100e89b071d4beb4779b6700433af00c1635e73"}
request.data.description
String Optional

Same service description_digest.

Source: Same service description_digest.

Example hmac-sha256:c5b18e26a3352dc8ed0fa104511c39b533864d33130270f9f904eb0372658d08
request.data.local
Boolean Optional

Fixed false.

Source: Fixed false.

Example false
request.data.options
Object Optional

Required container.

Source: Required container.

Example {"file_path":"hmac-sha256:1ccac0e264b9267343c6b6b960db39af64dfebdbdc0f75453f4259dd88efa9c3"}
request.data.options.file_path
String Optional

Same service path_digest.

Source: Same service path_digest.

Example hmac-sha256:1ccac0e264b9267343c6b6b960db39af64dfebdbdc0f75453f4259dd88efa9c3
request.data.type
String Optional

Same service type_digest.

Source: Same service type_digest.

Example hmac-sha256:65abaf3c64bbae2c283b165b7100e89b071d4beb4779b6700433af00c1635e73
request.id
String Optional

fake.uuid4(), fresh synthetic request ID.

Source: fake.uuid4(), fresh synthetic request ID.

Example 59b74f26-8874-4a6d-a75c-c55e67bf965c
request.mount_accessor
String Optional

Fixed "system_53409ed3".

Source: Fixed "system_53409ed3".

Example system_53409ed3
request.mount_class
String Optional

Fixed "secret".

Source: Fixed "secret".

Example secret
request.mount_point
String Optional

Fixed "sys/".

Source: Fixed "sys/".

Example sys/
request.mount_running_version
String Optional

Fixed "v1.18.4+builtin.vault".

Source: Fixed "v1.18.4+builtin.vault".

Example v1.18.4+builtin.vault
request.mount_type
String Optional

Fixed "system".

Source: Fixed "system".

Example system
request.namespace
Object Optional

Required container.

Source: Required container.

Example {"id":"root"}
request.namespace.id
String Optional

Fixed "root".

Source: Fixed "root".

Example root
request.operation
String Optional

Fixed "update".

Source: Fixed "update".

Example update
request.path
String Optional

Fixed "sys/audit/file".

Source: Fixed "sys/audit/file".

Example sys/audit/file
request.remote_address
String Optional

Named device vault-client.ip_address, fixed loopback in this profile.

Source: Named device vault-client.ip_address, fixed loopback in this profile.

Example 127.0.0.1
request.remote_port
Integer Optional

fake.pyint(min_value=49152, max_value=65535), integer local client-port subset.

Source: fake.pyint(min_value=49152, max_value=65535), integer local client-port subset.

Example 62687
time
String Optional

One now() through iso8601_utc, UTC with microseconds and Z.

Source: One now() through iso8601_utc, UTC with microseconds and Z.

Example 2026-10-01T22:48:12.991047Z
type
String Optional

Fixed "response".

Source: Fixed "response".

Example response