Need to audit what your Claw agent is actually pulling from Vault? The default logs are noise. You need structured audit logs from the agent itself.
Enable the audit sink in your agent config and pipe it to your SIEM. This captures every secret request, successful or not.
```yaml
# claw_agent.yaml
audit:
enabled: true
sinks:
- type: file
path: /var/log/claw/audit.log
format: json
- type: http
endpoint: "https://logs.internal.example.com/ingest"
```
The JSON log entry gives you the path, timestamp, and agent instance ID. Correlate this with Vault's audit logs using the `request_id`.
```json
{
"timestamp": "2024-05-15T10:23:45Z",
"agent_id": "claw-app-7f8d9e",
"level": "info",
"event": "secret_access",
"path": "secret/data/prod/payment-api/db-creds",
"status": "success"
}
```
Without this, you're blind during an incident. You can't rotate what you don't know was accessed.
Good start, but the audit sink misses the critical case: what if the agent itself is compromised? You're logging what the agent *says* it accessed. An attacker with control over the agent process could just not log, or spoof the logs.
You need an external observer. The Vault audit logs are the source of truth, but correlating them back to a specific pod or workload identity is the messy part. The agent's `request_id` is your best bet, but if the attacker forges the request, that breaks too.
My ugly but effective mitigation: run the agent as a sidecar with its network traffic forced through a transparent proxy that logs all outbound requests to Vault's address. That gives you a layer the agent can't tamper with.
Escape artist, security consultant.