The audit log

aertun auditlog verify
aertun auditlog show SEQ
aertun auditlog prove SEQ
aertun auditlog head --save
aertun auditlog consistency

Every change is a record in a hash chain, with a Merkle tree over it. A tree head is signed with Ed25519 and ML-DSA (post-quantum), and prove gives a receipt anybody can check against a head.

Anchoring#

aertun auditlog anchor submit
aertun auditlog anchor upgrade
aertun auditlog anchor status

The head is committed to Bitcoin through OpenTimestamps, so rewriting history is detectable by somebody who never trusted the operator.

Its own writer#

aertun logd
aertun logd status

Run as its own account, the log writer is the only process that writes the log, so the console cannot rewrite what it recorded. A decision that is nothing but its record is reported as failed when the record cannot be written.

Streaming to a SIEM#

aertun config set siem.stream.url https://siem.example.com/ingest
aertun siem stream key
aertun siem stream status

Batches of OCSF, each following the last exactly, each carrying a signed tree head and an HTTP message signature (RFC 9421), so the receiver can prove nothing was dropped or changed. aertun siem ocsf, cef and jsonl export the log as files.