FerrisKey
← Modules

Audit & Security Events

SeaWatch

Records every security-relevant action: logins, password resets, role assignments, config changes, each with the context compliance and incident work needs.

Read the docs All modules

Covers

Audit LogsSIEM ExportSOC 2ISO 27001GDPRIP TrackingTrace IDsOpenTelemetryIncident ResponseAnomaly Detection

Key capabilities

What SeaWatch does for you.

  • 01

    Structured Events

    Every event captures actor, target, IP address, user agent, trace ID, and event-specific details in a consistent JSON schema.

  • 02

    UUIDv7 Identifiers

    Time-ordered IDs make events naturally sortable and allow efficient range queries without full-table scans.

  • 03

    Actor Classification

    Events distinguish between user, service account, admin, and system actions for clear accountability.

  • 04

    OTel Integration

    Trace IDs link SeaWatch events to spans in Jaeger, Datadog, or any OpenTelemetry-compatible system.

  • 05

    SIEM Ready

    Forward events to Splunk, Elastic, or Datadog. The structured format maps directly to common SIEM schemas.

  • 06

    Compliance Evidence

    Generate SOC 2, ISO 27001, and GDPR audit evidence by querying on time range, actor, or event type.

How it works

From the first request to the result, in 4 steps.

  1. 1

    Action occurs

    A user logs in, an admin changes a realm setting, or a service account requests a token.

  2. 2

    Event constructed

    SeaWatch builds a structured event capturing who, what, when, where, and why with full context.

  3. 3

    Persisted asynchronously

    Events are written to storage off the main request path, so authentication takes no latency hit.

  4. 4

    Query & export

    Query events through the admin API by type, actor, or time range. Forward to your SIEM via webhooks.

Ready to use SeaWatch?

Full reference, configuration options, and examples in the documentation.

Open docs

Other modules