Logging Architecture

Purpose

This document describes the logging and audit trail architecture across Azure and AWS environments. The architecture is designed to meet HIPAA's 6-year log retention requirement (§164.316(b)(2)(i)) and SOC2 audit control requirements (CC7.2) while maintaining operational access to recent logs for troubleshooting and security monitoring.

1. Architecture Overview — Dual Logging System

The logging architecture implements three parallel paths to balance operational needs, active security monitoring, and long-term compliance retention:

┌─────────────────────────────────────────────────────────────────────┐
│                         LOG SOURCES                                  │
│  Entra ID │ Activity Log │ VMs │ NSGs │ CloudTrail │ VPC Flow Logs  │
│  Palo Alto Firewalls │ Intune │ GitHub                              │
└─────────────────────────────────────────────────────────────────────┘
                                  │
                ┌─────────────────┼─────────────────┐
                │                 │                 │
                ▼                 ▼                 ▼
         ┌─────────────┐   ┌─────────────┐  ┌──────────────┐
         │  HOT PATH   │   │  SIEM PATH  │  │ ARCHIVE PATH │
         │  (30 days)  │   │  (~1 year)  │  │  (6 years)   │
         └─────────────┘   └─────────────┘  └──────────────┘
                │                 │                 │
                ▼                 ▼                 ▼
         Log Analytics     Arctic Wolf      Azure Storage
           Workspace         SIEM            + AWS S3
          (per-env)                         (WORM/Object Lock)
                │                 │                 │
                ▼                 ▼                 ▼
         Operational       Active Security     Compliance
          Querying          Investigation       Audit Trail
         (KQL queries)     (Alerts, SOC)       (Immutable)

Path Purposes

Path	Retention	Purpose	Status
Hot	30 days	Operational troubleshooting, performance analysis, recent log queries via KQL	✅ Operational
SIEM	~1 year	Active security monitoring, threat detection, incident investigation	✅ Operational (Arctic Wolf)
Archive	6 years	HIPAA compliance, audit trail, long-term forensics, immutable evidence	✅ Operational

The archive path is independent of the SIEM — even if Arctic Wolf retention changes or the SIEM provider changes, the 6-year compliance archive remains intact and under direct organizational control.

2. Azure Logging (azure-infra and azure-dde-infra)

Entra ID Diagnostic Settings

Entra ID logs are sent to both hot (LAW) and archive (Storage Account) destinations:

Log Category	Enabled	Destination
AuditLogs	✅	LAW + Archive Storage
SignInLogs	✅	LAW + Archive Storage
NonInteractiveUserSignInLogs	✅	LAW + Archive Storage
ServicePrincipalSignInLogs	✅	LAW + Archive Storage
ManagedIdentitySignInLogs	✅	LAW + Archive Storage
ProvisioningLogs	✅	LAW + Archive Storage
ADFSSignInLogs	✅	LAW + Archive Storage
RiskyUsers	✅	LAW + Archive Storage
UserRiskEvents	✅	LAW + Archive Storage

Activity Log Diagnostic Settings

Azure Activity Log (subscription-level control plane operations) sent to LAW and archive:

Log Category	Enabled	Destination
Administrative	✅	LAW + Archive Storage
Security	✅	LAW + Archive Storage
Alert	✅	LAW + Archive Storage
Policy	✅	LAW + Archive Storage

Per-Environment Data Collection Rules (DCRs)

DCRs are configured with dual-destination routing — all resource logs go to both the local LAW (hot path) and archive storage (6-year path):

Environment	LAW Name	Hot Retention	Archive Destination
Production	law-prod	30 days	✅ Archive storage wired
Dashboard	law-dashboard	30 days	✅ Archive storage wired
DDE	law-dde	30 days	✅ Archive storage wired

NSG / VPC Flow Logs

NSG and VPC flow logs are redirected to archive storage with lifecycle policies and WORM immutability:

Flow Log Target	Destination	Lifecycle	Immutable
Azure NSGs (all environments)	Archive storage account	Hot → Cool 90d → Archive 365d	✅ WORM
AWS VPCs (all 7 accounts)	cirius-archive-logs-prod	Standard → Glacier 90d → Deep Archive 365d	✅ Object Lock GOVERNANCE

Event Hub → Arctic Wolf SIEM

Azure diagnostic settings stream logs to Event Hub, which forwards to Arctic Wolf SIEM for active monitoring:

Source	Event Hub	SIEM Retention
Entra ID logs	✅ Configured	~1 year (Arctic Wolf controlled)
Activity Log	✅ Configured	~1 year
Resource logs	✅ Configured	~1 year

Palo Alto Firewall Logs (Azure)

All three Azure/DDE firewalls forward logs through dedicated syslog VMs to Arctic Wolf and archive storage:

Firewall	Syslog VM	Arctic Wolf (VLC)	Archive
Azure production	syslogazp (firewall subnet)	✅ Active	✅ Via syslog VM
Azure dashboard	syslogazp (shared)	✅ Active	✅ Via syslog VM
DDE customer-facing	syslogdde (private subnet)	✅ Active	✅ Via syslog VM

See Palo Alto Firewall Overview for syslog VM configuration details.

Azure Archive Storage

Archive storage deployed across all three environments (azure-infra and azure-dde-infra):

Configuration	Value
Lifecycle policy	Hot → Cool at 90 days → Archive tier at 365 days
Immutability	WORM (time-based retention)
Scope	Per-environment storage accounts

3. AWS Logging (aws-infra)

CloudTrail Organization Trail

Configuration	Value
Trail Name	cirius-org-trail
Scope	Organization-wide (all 7 accounts)
S3 Bucket	cirius-cloudtrail-logs (Logging account)
Encryption	AWS KMS (customer-managed key)
Log File Validation	✅ Enabled (SHA-256 digest)
Management Events	✅ All accounts
Lifecycle	Standard → Glacier 90d → Deep Archive 365d

VPC Flow Logs

VPC	Destination	Object Lock	Retention
All VPCs (7 accounts)	cirius-archive-logs-prod	✅ GOVERNANCE mode	2190 days (6 years)

AWS Palo Alto Firewall Logs

Component	Status
Syslog VM	syslogawp — Ubuntu 22.04 LTS, t3.small, syslog-ng, IMDSv2 enforced, termination protection enabled
Arctic Wolf VLC	✅ Active ingestion confirmed
S3 archive shipping	✅ Operational — ships to cirius-archive-logs-prod
Log types	Traffic, threat, auth, system, config, HIP match

HIPAA Archive Bucket

Configuration	Value
Bucket Name	cirius-archive-logs-prod
Object Lock	GOVERNANCE mode (2190-day retention)
Lifecycle Policy	Standard → Glacier (90 days) → Deep Archive (365 days)
Versioning	✅ Enabled
Encryption	AES-256 (SSE-S3)
Public Access	❌ Blocked (all 4 settings)

AWS Security Services

Service	Purpose	Status
Security Hub	Compliance findings (NIST 800-53 Rev 5)	✅ Org-wide
GuardDuty	Threat detection	✅ All 7 accounts
Config	Resource configuration tracking	✅ All accounts
Audit Manager	Continuous HIPAA assessment	✅ Org-wide

4. Known Gaps and Remediation

Gap	Impact	Status
Azure WORM locked prematurely	Some archive containers deployed with locked=true before all log flows were validated. Empty containers cannot be deleted until retention expires (~2032). Containers receiving active data are correctly protected.	Accepted risk — no corrective action possible
GitHub and Intune audit logs not archived	No long-term retention beyond default platform retention	Planned Q2-Q3 2026
Historical log data lost during SIEM transitions	No audit trail prior to current Arctic Wolf deployment	Accepted — cannot recover

All previously listed DCR, NSG flow log, and AWS firewall gaps are resolved as of March 2026.

5. Log Source Inventory

Source	Platform	Hot	SIEM	Archive	Archive Immutable
Entra ID audit/sign-in logs	Azure	✅ 30d LAW	✅ Arctic Wolf	✅ WORM storage	✅
Azure Activity Log	Azure	✅ 30d LAW	✅ Arctic Wolf	✅ WORM storage	✅
VM diagnostic logs	Azure	✅ 30d LAW	✅ Arctic Wolf	✅ Archive wired via DCR	✅
NSG flow logs	Azure	—	—	✅ Archive with lifecycle	✅
Palo Alto firewall (Azure prod)	Azure	—	✅ Arctic Wolf VLC	✅ Via syslog VM	—
Palo Alto firewall (Azure dashboard)	Azure	—	✅ Arctic Wolf VLC	✅ Via syslog VM	—
Palo Alto firewall (DDE)	Azure	—	✅ Arctic Wolf VLC	✅ Via syslog VM	—
Palo Alto firewall (AWS DR)	AWS	—	✅ Arctic Wolf VLC	✅ Via syslog VM → S3	—
AWS CloudTrail (org trail)	AWS	—	—	✅ KMS-encrypted S3	—
VPC flow logs	AWS	—	—	✅ Object Lock GOVERNANCE	✅
Security Hub findings	AWS	✅ 90d console	—	—	—
GuardDuty findings	AWS	✅ Console	—	—	—
GitHub audit logs	GitHub	✅ Default	—	❌ Not archived	—
Intune audit logs	Azure	✅ Default	—	❌ Not archived	—

6. Compliance Mapping

Requirement	Control	How Logging Addresses It
HIPAA §164.312(b) — Audit controls	Activity logging on all systems	Azure Monitor, CloudTrail, NSG/VPC flow logs, firewall syslog
HIPAA §164.316(b)(2)(i) — 6-year retention	Logs retained for minimum required period	Archive storage with WORM/Object Lock deployed across all environments
SOC2 CC7.2 — Monitoring	System monitoring activities	Arctic Wolf SIEM with VLC active across all four firewalls
SOC2 CC7.3 — Evaluate and respond	Log review and response	SIEM alerting and Security Hub findings enable response
HITRUST 09.aa — Event logging	Comprehensive event logging	Entra ID, Activity Log, CloudTrail, firewall syslog

Document History

Date	Change	Author
April 2026	Added explicit syslog VM hostnames (syslogazp, syslogdde, syslogawp) to Azure and AWS Palo Alto sections; added link to Palo Alto Firewall Overview for VM config details	Kobe
March 2026	Updated to reflect completed remediation: DCR dual-destination wired in all environments; NSG/VPC flow logs redirected to archive with WORM/Object Lock; AWS firewall syslog operational via syslog VM with Arctic Wolf VLC active; archive status updated to Operational; removed resolved gaps from Known Gaps table	Rory
March 2, 2026	Fixed factual errors: CloudTrail/VPC flow log destinations corrected, Log Source Inventory statuses updated, Known Gaps corrected	Rory
March 2026	Initial draft documenting dual logging architecture	Rory

Related Documentation

• HIPAA Controls Matrix
• Azure Infrastructure Overview
• AWS DR Overview
• Palo Alto Firewall Overview
• Backup Architecture