feat(audit-logging): phase 2 - US.2 - System & Integration Activity Logging (#6383)

openaev-api/src/main/java/io/openaev/api/xtm_composer/XtmComposerApi.java

@@ -7,6 +7,7 @@
 import io.openaev.api.xtm_composer.dto.XtmComposerOutput;
 import io.openaev.api.xtm_composer.dto.XtmComposerRegisterInput;
 import io.openaev.api.xtm_composer.dto.XtmComposerUpdateStatusInput;
+import io.openaev.database.audit.AuditLogContext;
 import io.openaev.database.model.Action;
 import io.openaev.database.model.ResourceType;
 import io.openaev.rest.connector_instance.dto.ConnectorInstanceHealthInput;
@@ -65,6 +66,8 @@ public XtmComposerOutput register(@Valid @RequestBody XtmComposerRegisterInput i
   @ApiResponses(value = {@ApiResponse(responseCode = "200", description = "Successful refresh")})
   @Transactional(rollbackFor = Exception.class)
   public XtmComposerOutput refreshConnectivity(@PathVariable @NotBlank final String xtmComposerId) {
+    // Don't audit log because too much noise
+    AuditLogContext.setEnabled(false);
     return xtmComposerService.refreshConnectivity(xtmComposerId, Instant.now());
   }
 
@@ -137,6 +140,8 @@ public void receiveConnectorInstanceLogs(
       @PathVariable @NotBlank final String xtmComposerId,
       @PathVariable @NotBlank final String connectorInstanceId,
       @Valid @RequestBody ConnectorInstanceLogsInput input) {
+    // Don't audit log because already in UI of each connector
+    AuditLogContext.setEnabled(false);
     orchestrationService.pushLogsByConnectorInstance(
         xtmComposerId, connectorInstanceId, input.getLogs());
   }

openaev-api/src/main/java/io/openaev/rest/collector/service/CollectorService.java

@@ -5,6 +5,7 @@
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
+import io.openaev.database.audit.AuditLoggedService;
 import io.openaev.database.model.*;
 import io.openaev.database.repository.CollectorRepository;
 import io.openaev.database.repository.CollectorTypeRepository;
@@ -32,7 +33,8 @@
 
 @Slf4j
 @Service
-public class CollectorService extends AbstractConnectorService<Collector, CollectorOutput> {
+public class CollectorService extends AbstractConnectorService<Collector, CollectorOutput>
+    implements AuditLoggedService {
 
   @Resource protected ObjectMapper mapper;
 
@@ -274,6 +276,8 @@ public Collector register(
     Collector collector =
         collectorRepository.findById(ConnectorCompositeId.of(id, tenantId)).orElse(null);
 
+    Map<String, Object> before = collector != null ? collector.significantState(mapper) : null;
+
     SecurityPlatform securityPlatform =
         securityPlatformId != null
             ? securityPlatformRepository
@@ -307,6 +311,12 @@ public Collector register(
     if (securityPlatform != null) {
       collector.setSecurityPlatform(securityPlatform);
     }
+
+    // Suppress audit logging for heartbeat-only updates (no significant change)
+    if (before != null) {
+      suppressAuditIfUnchanged(before, collector.significantState(mapper));
+    }
+
     return collectorRepository.save(collector);
   }
 

openaev-api/src/main/java/io/openaev/service/InjectorService.java

@@ -3,7 +3,9 @@
 import static io.openaev.helper.StreamHelper.fromIterable;
 import static io.openaev.service.FileService.INJECTORS_IMAGES_BASE_PATH;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import io.openaev.context.TenantContext;
+import io.openaev.database.audit.AuditLoggedService;
 import io.openaev.database.model.*;
 import io.openaev.database.repository.AttackPatternRepository;
 import io.openaev.database.repository.ConnectorInstanceConfigurationRepository;
@@ -32,6 +34,7 @@
 import io.openaev.service.organization.OrganizationService;
 import io.openaev.utils.mapper.CatalogConnectorMapper;
 import io.openaev.utils.mapper.InjectorMapper;
+import jakarta.annotation.Resource;
 import jakarta.persistence.EntityManager;
 import jakarta.validation.constraints.NotBlank;
 import java.io.InputStream;
@@ -49,7 +52,10 @@
 @Slf4j
 @Service("coreInjectorService")
 // TODO needs to be merged with integrations/InjectorService
-public class InjectorService extends AbstractConnectorService<Injector, InjectorOutput> {
+public class InjectorService extends AbstractConnectorService<Injector, InjectorOutput>
+    implements AuditLoggedService {
+
+  @Resource protected ObjectMapper mapper;
 
   // Built-in injectors (Email, Manual, HTTP query, ...) are shipped by the
   // platform, so their contracts are authored by Filigran.
@@ -254,6 +260,8 @@ public InjectorRegistration registerExternalInjector(
       // We need to support upsert for registration
       Injector injector = injectorRepository.findByInjectorId(input.getId()).orElse(null);
       if (injector != null) {
+        // Capture significant state before mutation
+        Map<String, Object> before = injector.significantState(mapper);
         updateExistingExternalInjector(
             injector,
             input.getType(),
@@ -265,6 +273,8 @@ public InjectorRegistration registerExternalInjector(
             input.getExecutorClearCommands(),
             input.getPayloads(),
             authorOrganization);
+        // Suppress audit logging for heartbeat-only updates (no significant change)
+        suppressAuditIfUnchanged(before, injector.significantState(mapper));
       } else {
         // save the injector
         Injector newInjector = new Injector();

openaev-api/src/main/java/io/openaev/service/connector_instances/ConnectorInstanceService.java

@@ -11,6 +11,7 @@
 import io.openaev.context.TenantContext;
 import io.openaev.context.TenantScopedTransaction;
 import io.openaev.context.TxCtx;
+import io.openaev.database.audit.AuditLoggedService;
 import io.openaev.database.model.*;
 import io.openaev.database.repository.*;
 import io.openaev.integration.Manager;
@@ -37,7 +38,7 @@
 
 @Slf4j
 @Service
-public class ConnectorInstanceService {
+public class ConnectorInstanceService implements AuditLoggedService {
 
   private final ObjectMapper objectMapper;
   private final ConnectorInstanceMapper connectorInstanceMapper;
@@ -747,10 +748,21 @@ public ConnectorInstancePersisted patchConnectorInstanceHealthCheck(
     ConnectorInstancePersisted instance =
         this.connectorInstanceByIdIgnoringTenantFilter(connectorInstanceId);
 
+    // Capture only the fields that should drive audit suppression for healthcheck pings.
+    Map<String, Object> before = new HashMap<>();
+    before.put("inRebootLoop", instance.isInRebootLoop());
+    before.put("restartCount", instance.getRestartCount());
+
     instance.setInRebootLoop(input.isInRebootLoop());
     instance.setStartedAt(input.getStartedAt());
     instance.setRestartCount(input.getRestartCount());
 
+    Map<String, Object> after = new HashMap<>();
+    after.put("inRebootLoop", instance.isInRebootLoop());
+    after.put("restartCount", instance.getRestartCount());
+
+    // Suppress audit logging for heartbeat-only updates (no significant change)
+    suppressAuditIfUnchanged(before, after);
     return (ConnectorInstancePersisted) this.save(instance);
   }
 

openaev-model/src/main/java/io/openaev/database/model/Collector.java

@@ -6,6 +6,8 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import io.hypersistence.utils.hibernate.type.json.JsonType;
+import io.openaev.database.audit.AuditStateCapturable;
+import io.openaev.database.audit.AuditStateIgnore;
 import io.openaev.database.audit.ModelBaseListener;
 import io.openaev.jsonapi.BusinessId;
 import jakarta.persistence.*;
@@ -30,7 +32,7 @@
 @Table(name = "collectors")
 @EntityListeners({ModelBaseListener.class})
 @IdClass(ConnectorCompositeId.class)
-public class Collector extends BaseConnectorEntity implements TenantIdBase {
+public class Collector extends BaseConnectorEntity implements TenantIdBase, AuditStateCapturable {
 
   @Id
   @Column(name = "collector_id")
@@ -78,11 +80,13 @@ public class Collector extends BaseConnectorEntity implements TenantIdBase {
   @Column(name = "collector_created_at")
   @JsonProperty("collector_created_at")
   @NotNull
+  @AuditStateIgnore
   private Instant createdAt = now();
 
   @Column(name = "collector_updated_at")
   @JsonProperty("collector_updated_at")
   @NotNull
+  @AuditStateIgnore
   private Instant updatedAt = now();
 
   @Column(name = "collector_last_execution")
@@ -94,6 +98,7 @@ public class Collector extends BaseConnectorEntity implements TenantIdBase {
   @ManyToOne(fetch = FetchType.LAZY)
   @JoinColumn(name = "collector_security_platform")
   @JsonProperty("collector_security_platform")
+  @AuditStateIgnore
   private SecurityPlatform securityPlatform;
 
   @JsonProperty("collector_state")

openaev-model/src/main/java/io/openaev/database/model/ConnectorInstancePersisted.java

@@ -3,6 +3,8 @@
 import com.fasterxml.jackson.annotation.JsonBackReference;
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import io.openaev.database.audit.AuditStateCapturable;
+import io.openaev.database.audit.AuditStateIgnore;
 import io.openaev.database.audit.ModelBaseListener;
 import io.openaev.database.audit.TenantBaseListener;
 import jakarta.persistence.*;
@@ -32,7 +34,8 @@
 @Entity(name = "ConnectorInstance")
 @Table(name = "connector_instances")
 @EntityListeners({ModelBaseListener.class, TenantBaseListener.class})
-public class ConnectorInstancePersisted extends ConnectorInstance implements TenantBase {
+public class ConnectorInstancePersisted extends ConnectorInstance
+    implements TenantBase, AuditStateCapturable {
   @Id
   @Column(name = "connector_instance_id")
   @GeneratedValue(generator = "UUID")
@@ -54,6 +57,7 @@ public class ConnectorInstancePersisted extends ConnectorInstance implements Ten
 
   @Column(name = "connector_instance_started_at")
   @JsonProperty("connector_instance_started_at")
+  @AuditStateIgnore
   private Instant startedAt;
 
   // Fixes a bug due to a new version of jackson and lombok
@@ -70,6 +74,7 @@ public class ConnectorInstancePersisted extends ConnectorInstance implements Ten
       orphanRemoval = true)
   @JsonProperty("connector_instance_logs")
   @NotNull
+  @AuditStateIgnore
   private Set<ConnectorInstanceLog> logs = new HashSet<>();
 
   /** Shadow base class members */

openaev-model/src/main/java/io/openaev/database/model/Executor.java

@@ -5,6 +5,8 @@
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import io.hypersistence.utils.hibernate.type.array.StringArrayType;
+import io.openaev.database.audit.AuditStateCapturable;
+import io.openaev.database.audit.AuditStateIgnore;
 import io.openaev.database.audit.ModelBaseListener;
 import jakarta.persistence.*;
 import jakarta.validation.constraints.NotBlank;
@@ -27,7 +29,7 @@
  * inspector scopes every query, and write attribution is explicit via TenantWriteScopeResolver. Do
  * not re-add either.
  */
-public class Executor extends BaseConnectorEntity implements TenantIdBase {
+public class Executor extends BaseConnectorEntity implements TenantIdBase, AuditStateCapturable {
 
   @Id
   @Column(name = "executor_id")
@@ -70,11 +72,13 @@ public class Executor extends BaseConnectorEntity implements TenantIdBase {
   @Column(name = "executor_created_at")
   @JsonProperty("executor_created_at")
   @NotNull
+  @AuditStateIgnore
   private Instant createdAt = now();
 
   @Column(name = "executor_updated_at")
   @JsonProperty("executor_updated_at")
   @NotNull
+  @AuditStateIgnore
   private Instant updatedAt = now();
 
   @JsonIgnore

openaev-model/src/main/java/io/openaev/database/model/Injector.java

@@ -8,6 +8,8 @@
 import io.hypersistence.utils.hibernate.type.array.StringArrayType;
 import io.hypersistence.utils.hibernate.type.basic.PostgreSQLHStoreType;
 import io.openaev.annotation.Queryable;
+import io.openaev.database.audit.AuditStateCapturable;
+import io.openaev.database.audit.AuditStateIgnore;
 import io.openaev.database.audit.ModelBaseListener;
 import io.openaev.healthcheck.enums.ExternalServiceDependency;
 import io.openaev.helper.MonoIdSerializer;
@@ -34,7 +36,7 @@
  * inspector scopes every query, and write attribution is explicit via TenantWriteScopeResolver. Do
  * not re-add either.
  */
-public class Injector extends BaseConnectorEntity implements TenantIdBase {
+public class Injector extends BaseConnectorEntity implements TenantIdBase, AuditStateCapturable {
 
   @Id
   @Column(name = "injector_id")
@@ -86,11 +88,13 @@ public class Injector extends BaseConnectorEntity implements TenantIdBase {
   @Column(name = "injector_created_at")
   @JsonProperty("injector_created_at")
   @NotNull
+  @AuditStateIgnore
   private Instant createdAt = now();
 
   @Column(name = "injector_updated_at")
   @JsonProperty("injector_updated_at")
   @NotNull
+  @AuditStateIgnore
   private Instant updatedAt = now();
 
   @Queryable(filterable = true, searchable = true)
@@ -109,6 +113,7 @@ public class Injector extends BaseConnectorEntity implements TenantIdBase {
   @JsonSerialize(using = MonoIdSerializer.class)
   @JsonProperty("injector_security_platform")
   @Schema(implementation = String.class)
+  @AuditStateIgnore
   private SecurityPlatform securityPlatform;
 
   @OneToMany(mappedBy = "injector", fetch = FetchType.LAZY)