119 lines
5.5 KiB
PHP
119 lines
5.5 KiB
PHP
<?php
|
||
|
||
// Audit log page strings (R16). Shared buttons live in common.php.
|
||
return [
|
||
// Header
|
||
'eyebrow' => 'Security',
|
||
'heading' => 'Audit log',
|
||
'event_count' => ':count events',
|
||
|
||
// Events panel
|
||
'panel_title' => 'Events',
|
||
'panel_subtitle' => 'newest first',
|
||
'pagination_nav' => 'Audit pages',
|
||
'pagination_prev' => 'Previous',
|
||
'pagination_next' => 'Next',
|
||
'search_label' => 'Search audit log',
|
||
'search_placeholder' => 'Actor, action, target …',
|
||
|
||
// Empty state
|
||
'show_detail' => 'Show details',
|
||
'empty_title' => 'No events',
|
||
'empty_filtered' => 'No audit entries found for “:query”.',
|
||
'empty_none' => 'There are no audit entries yet.',
|
||
|
||
// Retention
|
||
'retention_title' => 'Retention',
|
||
'retention_subtitle' => 'Automatically prune the audit log',
|
||
'retention_label' => 'Retention',
|
||
'retention_unlimited' => 'unlimited',
|
||
'retention_days' => ':count days',
|
||
'retention_save' => 'Save',
|
||
'retention_saved_notify' => 'Retention policy saved.',
|
||
'retention_hint' => 'Number of days (1–3650). Leave empty to keep entries forever. Older entries are deleted daily.',
|
||
|
||
// Human-readable labels for the raw action codes shown in the event list.
|
||
'actions' => [
|
||
'service.start' => 'Service started',
|
||
'service.stop' => 'Service stopped',
|
||
'service.restart' => 'Service restarted',
|
||
'service.start.failed' => 'Service start failed',
|
||
'service.stop.failed' => 'Service stop failed',
|
||
'service.restart.failed' => 'Service restart failed',
|
||
'alert.rule_create' => 'Alert rule created',
|
||
'alert.rule_update' => 'Alert rule changed',
|
||
'alert.rule_delete' => 'Alert rule deleted',
|
||
'alert.channels_update' => 'Alert channels changed',
|
||
'audit.retention_set' => 'Retention changed',
|
||
'auth.login_failed' => 'Failed sign-in',
|
||
'auth.2fa_failed' => 'Failed 2FA check',
|
||
'auth.ip_banned' => 'IP address banned',
|
||
'auth.ip_unbanned' => 'IP ban lifted',
|
||
'auth.protection_updated' => 'Login protection changed',
|
||
'deploy.update_request' => 'Update requested',
|
||
'deploy.staging_release' => 'Staging release requested',
|
||
'deploy.staging_release_failed' => 'Staging release failed',
|
||
'deploy.public' => 'Public promotion triggered',
|
||
'deploy.public_failed' => 'Public promotion failed',
|
||
'deploy.stable' => 'Stable promotion triggered',
|
||
'deploy.stable_failed' => 'Stable promotion failed',
|
||
'deploy.yank' => 'Release retracted',
|
||
'deploy.yank_failed' => 'Yank failed',
|
||
'fail2ban.ban' => 'fail2ban: IP banned',
|
||
'fail2ban.unban' => 'fail2ban: IP unbanned',
|
||
'fail2ban.configure' => 'fail2ban configured',
|
||
'fail2ban.ignoreip_add' => 'fail2ban: exception added',
|
||
'fail2ban.ignoreip_remove' => 'fail2ban: exception removed',
|
||
'cert.endpoint_add' => 'Certificate endpoint added',
|
||
'cert.endpoint_delete' => 'Certificate endpoint removed',
|
||
'command.run' => 'Fleet command run',
|
||
'docker.action' => 'Container action',
|
||
'runbook.create' => 'Runbook created',
|
||
'runbook.delete' => 'Runbook deleted',
|
||
'file.edit' => 'File edited',
|
||
'firewall.rule_add' => 'Firewall rule added',
|
||
'firewall.rule_delete' => 'Firewall rule deleted',
|
||
'group.create' => 'Server group created',
|
||
'health.check_add' => 'Uptime check added',
|
||
'health.check_delete' => 'Uptime check removed',
|
||
'group.update' => 'Server group changed',
|
||
'group.delete' => 'Server group deleted',
|
||
'group.members' => 'Group membership changed',
|
||
'mail.configure' => 'E-mail (SMTP) configured',
|
||
'password.change' => 'Password changed',
|
||
'patch.apply' => 'Updates applied',
|
||
'password.reset' => 'Password reset',
|
||
'profile.update' => 'Profile updated',
|
||
// Neutral, WAF/IDS-style labels — deliberately do NOT reveal the deception layer to anyone
|
||
// reading the audit log. The DB action keys stay `security.honeypot_*`; only the visible text
|
||
// is disguised so an attacker with panel/audit access cannot tell the decoy paths are a trap.
|
||
'security.honeypot_hit' => 'Attack attempt',
|
||
'security.honeypot_login' => 'Login attack attempt',
|
||
'security.honeytoken_used' => 'Compromised credentials',
|
||
'server.create' => 'Server added',
|
||
'server.credential_updated' => 'SSH credentials updated',
|
||
'ssh_key.add' => 'SSH key added',
|
||
'system.package_upgrade' => 'Package upgraded',
|
||
'system.settings_updated' => 'System settings changed',
|
||
'tls.cert_request' => 'TLS certificate requested',
|
||
'two_factor.recovery_regenerate' => 'Backup codes regenerated',
|
||
'user.create' => 'User created',
|
||
'user.delete' => 'User deleted',
|
||
'user.logout' => 'Session ended',
|
||
'user.role_change' => 'Role changed',
|
||
'webauthn.register' => 'Security key registered',
|
||
'webauthn.remove' => 'Security key removed',
|
||
'wg.setup' => 'WireGuard set up',
|
||
'wg.add-peer' => 'WireGuard peer added',
|
||
'wg.remove-peer' => 'WireGuard peer removed',
|
||
'wg.set-endpoint' => 'WireGuard endpoint changed',
|
||
'wg.set-port' => 'WireGuard port changed',
|
||
'wg.set-subnet' => 'WireGuard subnet changed',
|
||
'wg.set-dns' => 'WireGuard DNS changed',
|
||
'wg.action-failed' => 'WireGuard action failed',
|
||
],
|
||
|
||
// Page title
|
||
'title' => 'Audit log — Clusev',
|
||
];
|