Audit log

SIEMLite records what people do in it as events from the built-in INTERNAL source: sign-ins, failed and blocked sign-ins, sign-outs, changes to users, sources, parsers and rules, alerts acknowledged or closed, and backups created, downloaded, uploaded, restored or deleted. Command-line changes are recorded too, as "command line (user)". Each event names who did it and from which address, and has an action field such as signin.failed or user.delete. Search for them in the Database by choosing the INTERNAL source, or with a search like "sign-in failed". They are kept, and removed by retention, like any other events.

A failed sign-in names the account only if it exists; otherwise it says "an unknown username", so a password typed into the username field is never stored. Every failed sign-in is recorded until the address is locked out; the lockout is recorded once, not each retry. Beyond 600 failed sign-ins a minute (a flood from many addresses) the rest are counted in one Critical event, which raises an alert. Every analyst who isn't limited to some sources can read the audit log and acknowledge or close alerts.