Audit Metadata Ontology

FLOW ALGEBRA

Ontology: Audit Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata/audit-metadata-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "AuditMetadataOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: SecurityMetadata
  subject: AuditMetadata
  purpose:
    - represent auditable events, actors, resources, actions, outcomes, evidence, controls, and provenance
    - preserve event identity, principal, resource, action, timestamp, source, result, integrity, retention, and chain-of-custody context
    - support security auditing, compliance auditing, accountability, incident investigation, forensics, and AI-assisted reasoning
    - distinguish audit records from raw events, alerts, incidents, assessments, and complete proof of activity or non-activity
    - enable machine-readable reasoning over audit lifecycles

# ---------- CORE ----------
entity AuditMetadata:
  type: SecurityMetadata
  describes: AuditEvent
  may_include:
    - audit_identifier
    - event_identifier
    - event_type
    - principal
    - actor
    - resource
    - action
    - timestamp
    - source
    - outcome
    - session_identifier
    - correlation_identifier
    - policy
    - evidence
    - integrity
    - retention
    - confidence
    - provenance

entity AuditEvent:
  type: EventMetadata

entity AuditIdentifier:
  type: Identifier
  identifies: AuditEvent

relationships:
  AuditMetadata -> DESCRIBES -> AuditEvent
  AuditEvent -> IDENTIFIED_BY -> AuditIdentifier
  AuditEvent -> PERFORMED_BY -> AuditPrincipal
  AuditEvent -> AFFECTS -> AuditedResource
  AuditEvent -> PERFORMS -> AuditedAction
  AuditEvent -> HAS_OUTCOME -> AuditOutcome
  AuditEvent -> RECORDED_BY -> AuditSource
  AuditEvent -> MAY_HAVE_EVIDENCE -> AuditEvidence
  AuditMetadata -> MAY_HAVE_PROVENANCE -> AuditProvenance

# ---------- IDENTITY / ACTOR ----------
rule audit_identity:
  AuditEvent SHOULD have stable AuditIdentifier

rule event_identifier:
  source event identifier != audit-record identifier

entity AuditPrincipal:
  type: SecurityPrincipal
  may_be:
    - User
    - ServiceAccount
    - Application
    - Device
    - Workload
    - Organization
    - AutomatedAgent
    - UnknownPrincipal

rule actor_identity:
  displayed username != independently verified actor identity

rule impersonation:
  acting principal SHOULD remain distinguishable
  from impersonated or delegated identity

# ---------- RESOURCE / ACTION / OUTCOME ----------
entity AuditedResource:
  type: Resource

entity AuditedAction:
  type: ActionMetadata
  may_be:
    - create
    - read
    - update
    - delete
    - execute
    - authenticate
    - authorise
    - deny
    - grant
    - revoke
    - configure
    - export
    - import
    - share
    - approve
    - administer
    - implementation_specific

entity AuditOutcome:
  type: StatusMetadata
  may_be:
    - success
    - failure
    - denied
    - partial
    - error
    - cancelled
    - unknown

rule outcome:
  successful event != authorised event
  unless authorisation evidence supports it

rule failure:
  failed event != malicious event by itself

# ---------- TIME / SOURCE / CORRELATION ----------
entity AuditTimestamp:
  type: TemporalMetadata
  may_include:
    - event_time
    - record_time
    - ingestion_time
    - timezone
    - clock_source
    - clock_accuracy

rule time:
  event_time != record_time where logging is delayed

entity AuditSource:
  type: EvidenceSource
  may_include:
    - source_identifier
    - source_type
    - system
    - component
    - logger
    - collector
    - version

source_types:
  - application_log
  - operating_system_log
  - database_log
  - network_log
  - identity_provider_log
  - cloud_service_log
  - security_tool
  - physical_access_log
  - audit_platform
  - implementation_specific

rule source:
  AuditSource SHOULD preserve origin and collection context

entity AuditSession:
  type: ContextMetadata
  may_include:
    - session_identifier
    - principal
    - start_time
    - end_time
    - authentication_context

entity AuditCorrelation:
  type: RelationshipMetadata
  may_include:
    - correlation_identifier
    - related_events
    - correlation_method
    - confidence

rule correlation:
  correlated events != same event

# ---------- EVIDENCE / INTEGRITY ----------
entity AuditEvidence:
  type: SecurityEvidence
  may_include:
    - evidence_identifier
    - source
    - raw_event_reference
    - collection_time
    - collector
    - integrity
    - signature
    - chain_of_custody

rule evidence:
  audit interpretation != raw evidence

entity AuditIntegrityMetadata:
  type: SecurityMetadata
  may_include:
    - checksum
    - cryptographic_hash
    - digital_signature
    - append_only_state
    - immutability_state
    - verification_time

rule integrity:
  audit integrity SHOULD preserve verification method and time

rule integrity_completeness:
  intact audit record != complete audit history

entity AuditImmutability:
  type: SecurityControlMetadata

rule immutability:
  claimed immutable log != verified tamper-resistant log
  without enforcement evidence

entity AuditHashChain:
  type: IntegrityMetadata
  may_include:
    - previous_record_hash
    - current_record_hash
    - algorithm
    - sequence_identifier

rule chain:
  hash chain MAY support detection of modification or deletion
  but != proof no event was omitted before collection

# ---------- AUDIT TRAIL / TYPES ----------
entity AuditTrail:
  type: EventCollection
  contains: AuditEvent

rule trail:
  AuditTrail SHOULD preserve event ordering and correlation relationships

rule trail_completeness:
  available trail != necessarily complete trail

entity SecurityAuditMetadata:
  subtype_of: AuditMetadata

entity ComplianceAuditMetadata:
  subtype_of: AuditMetadata

entity AccessAuditMetadata:
  subtype_of: AuditMetadata

entity AuthenticationAuditMetadata:
  subtype_of: AuditMetadata

entity AuthorisationAuditMetadata:
  subtype_of: AuditMetadata

entity ChangeAuditMetadata:
  subtype_of: AuditMetadata

entity AdministrativeAuditMetadata:
  subtype_of: AuditMetadata

rule security_audit:
  security audit event != confirmed security incident

rule compliance_audit:
  audit evidence != compliance conclusion

rule access:
  access log success != valid authorisation
  without authorisation evidence

rule decision_enforcement:
  authorisation decision != proof of enforcement

# ---------- POLICY / RETENTION / ACCESS ----------
entity AuditPolicy:
  type: SecurityPolicy
  may_include:
    - policy_identifier
    - policy_version
    - event_types
    - required_fields
    - retention_period
    - protection_requirements
    - review_requirements
    - effective_from
    - effective_until

rule policy:
  audit policy != evidence required events were actually recorded

entity AuditRetentionMetadata:
  type: LifecycleMetadata
  may_include:
    - retention_period
    - retain_until
    - policy
    - legal_hold
    - deletion_rule
    - archive_state

rule retention:
  audit retention SHOULD preserve policy and temporal scope

entity AuditAccessMetadata:
  type: AccessControlMetadata
  may_include:
    - principal
    - audit_scope
    - permission
    - access_time
    - purpose

rule audit_access:
  audit data MAY itself require restricted access

# ---------- MONITORING / REVIEW / FINDINGS ----------
entity AuditMonitoringMetadata:
  type: MonitoringMetadata
  may_include:
    - monitored_event_types
    - detection_rules
    - alerting
    - review_frequency
    - last_review_time

rule monitoring:
  audit collection != active monitoring
  unless review or detection processes exist

entity AuditReviewEvent:
  type: AssessmentEvent
  may_include:
    - reviewer
    - audit_scope
    - review_time
    - findings
    - actions

rule review:
  audit record existence != evidence it was reviewed

entity AuditFinding:
  type: AssessmentFinding
  may_include:
    - finding_identifier
    - related_events
    - evidence
    - severity
    - interpretation
    - status

rule finding:
  AuditFinding SHOULD distinguish inference from observed event data

# ---------- ABSENCE / FORENSICS / RISK ----------
rule alert:
  audit-derived alert != confirmed incident

rule incident:
  AuditEvent != SecurityIncident
  unless incident criteria and evidence establish classification

rule absence:
  absence of audit record != proof event did not occur

rule logging_gap:
  missing records MAY reflect non-occurrence, logging failure,
  collection failure, deletion, filtering, or unknown cause

entity AuditChainOfCustody:
  type: EvidenceMetadata
  may_include:
    - evidence_identifier
    - custodian
    - transfer_time
    - transfer_from
    - transfer_to
    - integrity_verification

rule custody:
  forensic use SHOULD preserve chain of custody
  where evidential requirements apply

entity AuditRisk:
  type: RiskMetadata
  may_include:
    - logging_gap
    - clock_drift
    - integrity_failure
    - excessive_retention
    - insufficient_retention
    - unauthorised_access
    - missing_fields
    - collection_failure
    - risk_level
    - assessment_time

# ---------- CONFIDENCE / PROVENANCE ----------
entity AuditConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

entity AuditProvenance:
  type: ProvenanceMetadata
  may_include:
    - source
    - source_event_identifier
    - collection_time
    - collector
    - ingestion_time
    - transformations
    - correlation
    - integrity_verification
    - review_events
    - archival_events

rule provenance:
  AuditMetadata SHOULD preserve collection and transformation history

# ---------- VALIDATION ----------
validation:
  require:
    - identifiable_audit_event
    - event_time_or_record_time
    - audit_source

  reject:
    - username_presented_as verified_actor_without evidence
    - success_presented_as valid_authorisation_without evidence
    - failed_event_presented_as malicious_event_without evidence
    - audit_event_presented_as confirmed_incident_without evidence
    - audit_evidence_presented_as compliance_conclusion
    - authorisation_decision_presented_as enforcement_without evidence
    - immutable_claim_presented_as verified_tamper_resistance_without evidence
    - intact_record_presented_as complete_audit_history
    - absence_of_record_presented_as proof_of_non_occurrence
    - correlated_events_presented_as identical_event

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "audit metadata" ~= "metadata describing auditable events and evidence"
  "audit event" ~= "event represented for accountability or review"
  "audit trail" ~= "ordered collection of auditable event records"
  "security audit metadata" ~= "audit metadata concerning security-relevant activity"
  "access audit metadata" ~= "audit metadata concerning resource access"
  "audit evidence" ~= "evidence supporting interpretation of auditable activity"

  PRESERVE distinctions:
    audit_record != raw_event
    audit_event != security_incident
    audit_alert != confirmed_incident
    actor_label != verified_actor_identity
    success != authorised_action
    failure != malicious_activity
    evidence != compliance_conclusion
    decision != enforcement
    integrity != completeness
    immutability_claim != verified_tamper_resistance
    correlation != identity
    absence_of_log != proof_of_non_occurrence
    audit_collection != audit_review
    audit_collection != active_monitoring

# ---------- CONFIDENCE ----------
CONFIDENCE:
  explicit_audit_metadata:
    score: 1.00
  cryptographically_verified_audit_record:
    score: 0.99
  verified_source_and_timestamp:
    score: 0.99
  preserved_chain_of_custody:
    score: 0.99
  strong_event_correlation:
    score: 0.95
  inferred_actor_from_username_only:
    score: <= 0.70
  incomplete_audit_trail:
    score: <= 0.65
  uncertain_clock_state:
    score: <= 0.65
  unknown_collection_gap:
    score: <= 0.55
  incomplete_audit_provenance:
    score: <= 0.55
    action: preserve uncertainty

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_event_record:
    - assign AuditIdentifier
    - preserve source event identifier
    - record principal, resource, action, time, and outcome
    - record AuditSource
    - calculate integrity evidence where applicable
    - initialise provenance

  on_collection:
    - preserve source record
    - record collection and ingestion time
    - validate required fields
    - preserve transformation history
    - update provenance

  on_correlation:
    - identify related events
    - record correlation method
    - assign correlation confidence
    - avoid unsupported event identity inference
    - update provenance

  on_review:
    - define audit scope
    - inspect relevant events and evidence
    - create AuditReviewEvent
    - record findings and actions
    - update provenance

  on_integrity_failure:
    - preserve affected records
    - record verification failure
    - assess AuditRisk
    - investigate source and storage history
    - preserve uncertainty

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - audit_entities
    - relationships
    - identity_rules
    - event_rules
    - timestamp_rules
    - source_rules
    - integrity_rules
    - retention_rules
    - validation
    - semantic_equivalence
    - confidence
    - update_model

  canonicalisation:
    - preserve_audit_and_source_event_identifiers
    - preserve_principal_and_resource_identifiers
    - preserve_event_and_record_times
    - preserve_source_identifiers
    - preserve_event_order
    - preserve_correlation_evidence
    - preserve_integrity_and_provenance
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - security metadata ontology
    - auditable event, actor, resource, action, and outcome model
    - evidence, integrity, retention, correlation, and forensic provenance structure
    - security, compliance, access, authentication, authorisation, and change audit model

  operations:
    - identify audit events
    - resolve actors and principals
    - resolve resources and actions
    - distinguish event time from record time
    - inspect audit sources
    - correlate related events with confidence
    - inspect integrity and immutability evidence
    - traverse audit trails
    - inspect retention and access policy
    - distinguish alerts and incidents
    - evaluate findings and reviews
    - trace chain of custody and provenance
    - preserve uncertainty

  constraints:
    - do_not_equate_actor_label_with verified_actor_identity
    - do_not_equate_success_with valid_authorisation
    - do_not_equate_failure_with malicious_activity
    - do_not_equate_audit_event_with confirmed_incident
    - do_not_equate_evidence_with compliance_conclusion
    - do_not_equate_integrity_with completeness
    - do_not_infer_non_occurrence_from missing_record
    - preserve_events_sources_times_evidence_integrity_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - audit_identifier
    - event_identifier
    - principal_identifier
    - resource_identifier
    - action
    - outcome
    - source_identifier
    - session_identifier
    - correlation_identifier
    - event_time

  resolve:
    1. identify AuditEvent
    2. resolve source event and audit identifiers
    3. resolve principal, resource, action, and outcome
    4. inspect event, record, and ingestion times
    5. inspect AuditSource and evidence
    6. resolve session and correlation context
    7. inspect integrity, retention, and access state
    8. inspect review, findings, and incident relationships
    9. trace provenance and confidence
    10. return audit interpretation

  output:
    - audit_event
    - audit_identifier
    - source_event_identifier
    - principal
    - resource
    - action
    - outcome
    - timestamps
    - source
    - session
    - correlation
    - integrity
    - evidence
    - findings
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF source, timestamp, actor, resource, and integrity evidence validate
  THEN strengthen audit-event confidence

  IF multiple events correlate
  THEN infer related_activity_candidate
  BUT do_not infer identical event

  IF audit record is absent
  THEN preserve non-occurrence uncertainty

  IF audit evidence supports incident criteria
  THEN MAY classify related SecurityIncident
  subject_to incident validation

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: AuditMetadata
  audit_identity: machine_interpretable
  source_event_identity: preserved
  principals_resources_actions: explicit
  timestamps: multi_stage
  sources: traceable
  outcomes: authorisation_distinct
  correlation: confidence_aware
  integrity_and_immutability: evidence_based
  audit_trails: traversable
  retention_and_access: policy_aware
  findings_and_reviews: traceable
  chain_of_custody: preservable
  provenance: preserved
  uncertainty: explicit
  security_reasoning: enabled

end flow