Audit & Compliance

Concourse logs security-relevant events to a separate audit database for SOC 2 Type II compliance.

What gets logged

Action	Description
login	Successful login
login_failed	Failed login attempt
permission_denied	Unauthorized access attempt
user.created	User created
user.updated	User role changed
user.deleted	User deleted
board.created	Board created
workspace.created	Workspace created
workspace_member.added	Member added to workspace
relay.created	Relay registered
agent.created	Agent created
connection.query	SQL query executed via relay
connection.introspect	Schema introspection via relay

Each event includes: timestamp, actor (user ID, email, IP), action, resource type/ID, outcome, and request ID.

Separate audit database

The audit database is separate from the primary application database. This provides tamper resistance — application-level database access cannot modify audit records.

Default: file:///data/audit.db (SQLite on the same volume). For production: consider using a remote Turso instance: AUDIT_DATABASE_URL=libsql://audit-db.turso.io

SIEM webhook integration

Forward audit events to your SIEM or security monitoring system:

audit:
  webhook:
    enabled: true
    url: https://siem.example.com/api/events
    headers:
      Authorization: Bearer ${AUDIT_WEBHOOK_TOKEN}
    batch_size: 100
    flush_interval_secs: 5
    timeout_secs: 30

Events are batched (default 100 events or 5 seconds, whichever comes first) and POSTed as JSON arrays. Webhook failures are logged but do not block request processing.

Client IP tracking

Audit events record the client IP address. If Concourse is behind a reverse proxy, ensure the proxy sets X-Forwarded-For or X-Real-IP headers so the correct client IP is logged.