Audit log streaming
Works locallyWorks in the local build today.
Stream the audit log to your SIEM as it happens.
harebox audit sink new --kind s3 --url s3://my-bucket/harebox-audit
harebox audit sink list
A webhook sink gets the entries after its last batch, about once a minute, as {"sink": ..., "entries": [...]}, signed with HareBox-Signature the same way webhooks are. Its secret is shown once, when you create it. A sink starts from when it's made; earlier entries are in harebox audit. An s3 sink is recorded, but no bucket is written yet.