@openauditmodel/cli 0.4.1 → 0.4.2

package/examples/profiles/backup-and-recovery/valid/backup-complete.json

@@ -0,0 +1,56 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0002-7c4d-8b1e-2f3a40516202",
+  "time": "2026-03-14T02:41:37.880Z",
+  "event": {
+    "name": "backup.complete",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Nightly full backup of the orders database completed."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-engine",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "backup-run-2026-0314-0200"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-schedule-tier-1",
+    "policyVersion": "6"
+  },
+  "controlCategories": ["data-protection", "recoverability"],
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "backupType": "full",
+      "recoveryPoint": "2026-03-14T02:00:00Z",
+      "retentionClass": "operational-35-day",
+      "targetScope": "object-store-region-north",
+      "sizeBytes": 48213770,
+      "encryptedAtRest": true
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/backup-create.json

@@ -0,0 +1,56 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0001-7c4d-8b1e-2f3a40516201",
+  "time": "2026-03-14T02:00:04.120Z",
+  "event": {
+    "name": "backup.create",
+    "category": "data-infrastructure",
+    "type": "create",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Scheduled nightly backup run created for the orders database."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-scheduler",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7",
+    "businessUnitId": "unit-payments"
+  },
+  "request": {
+    "correlationId": "backup-run-2026-0314-0200"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "backup-policy-engine",
+    "policy": "backup-schedule-tier-1",
+    "policyVersion": "6"
+  },
+  "controlCategories": ["data-protection", "recoverability"],
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "backupType": "full",
+      "retentionClass": "operational-35-day",
+      "targetScope": "object-store-region-north",
+      "scheduleId": "schedule-nightly-orders"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/backup-delete.json

@@ -0,0 +1,83 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0005-7c4d-8b1e-2f3a40516205",
+  "time": "2026-03-16T09:14:30.220Z",
+  "event": {
+    "name": "backup.delete",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Unrestorable backup copy removed ahead of its retention date."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-3312",
+    "tenantId": "tenant-7",
+    "roles": ["backup-operator"]
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "backup-disposal-2026-0316"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-administration",
+    "policyVersion": "3",
+    "permissions": ["backup-delete"]
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-backup-disposal",
+    "requestId": "request-8842",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvers": [
+      {
+        "type": "user",
+        "id": "user-1180"
+      },
+      {
+        "type": "user",
+        "id": "user-2044"
+      }
+    ],
+    "approvedAt": "2026-03-16T09:12:00Z"
+  },
+  "reason": {
+    "code": "unrestorable-copy",
+    "text": "Verification found the copy unrestorable; it was removed so it could not be mistaken for a usable recovery point.",
+    "reference": "records/backup-verification/backup-2026-0301-0200"
+  },
+  "controlCategories": ["data-protection", "recoverability"],
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0301-0200",
+      "backupType": "incremental",
+      "retentionClass": "operational-35-day",
+      "approvalRequired": true
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/backup-expire.json

@@ -0,0 +1,56 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0006-7c4d-8b1e-2f3a40516206",
+  "time": "2026-04-18T01:05:09.660Z",
+  "event": {
+    "name": "backup.expire",
+    "category": "data-infrastructure",
+    "type": "delete",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Backup copy disposed of after its retention period elapsed."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-retention-engine",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "retention-sweep-2026-0418"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-retention",
+    "policyVersion": "6"
+  },
+  "reason": {
+    "code": "retention-elapsed",
+    "text": "Copy reached the end of its operational retention window."
+  },
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "backupType": "full",
+      "retentionClass": "operational-35-day",
+      "recoveryPoint": "2026-03-14T02:00:00Z"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/backup-verify.json

@@ -0,0 +1,67 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-0004-7c4d-8b1e-2f3a40516204",
+  "time": "2026-03-16T04:22:11.005Z",
+  "event": {
+    "name": "backup.verify",
+    "category": "data-infrastructure",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "info",
+    "summary": "Monthly restore rehearsal completed against an isolated environment."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-backup-verifier",
+    "tenantId": "tenant-7"
+  },
+  "resource": {
+    "type": "database",
+    "id": "database-orders",
+    "name": "orders-primary",
+    "parentId": "cluster-north-primary",
+    "classification": "confidential",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "verification-run-2026-0316"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-verification",
+    "policyVersion": "2"
+  },
+  "reason": {
+    "code": "scheduled-verification",
+    "text": "Monthly rehearsal required by the recovery testing schedule.",
+    "reference": "records/restore-rehearsal/rehearsal-2026-0316"
+  },
+  "evidence": [
+    {
+      "type": "document",
+      "reference": "records/restore-rehearsal/rehearsal-2026-0316",
+      "contentType": "application/pdf",
+      "createdAt": "2026-03-16T04:22:00Z"
+    }
+  ],
+  "controlCategories": ["recoverability"],
+  "metadata": {
+    "backup": {
+      "backupId": "backup-2026-0314-0200",
+      "backupType": "full",
+      "recoveryPoint": "2026-03-14T02:00:00Z",
+      "verificationStatus": "restore-tested",
+      "retentionClass": "operational-35-day"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/policy-update.json

@@ -0,0 +1,78 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-000c-7c4d-8b1e-2f3a4051620c",
+  "time": "2026-04-10T14:06:41.020Z",
+  "event": {
+    "name": "backup.policy.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Backup frequency for the orders database reduced from hourly to daily."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-3312",
+    "tenantId": "tenant-7",
+    "roles": ["backup-operator"]
+  },
+  "resource": {
+    "type": "backup-policy",
+    "id": "backup-policy-orders",
+    "name": "orders-protection",
+    "classification": "internal",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "backup-service",
+    "environment": "production",
+    "version": "4.2.0",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "change-request-4610"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "backup-administration",
+    "policyVersion": "3"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-change-advisory",
+    "requestId": "request-9411",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-10T14:02:00Z"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["frequency", "recoveryPointObjective"],
+    "before": {
+      "frequency": "hourly",
+      "recoveryPointObjective": "one-hour"
+    },
+    "after": {
+      "frequency": "daily",
+      "recoveryPointObjective": "twenty-four-hour"
+    },
+    "ticketId": "change-request-4610"
+  },
+  "reason": {
+    "code": "objective-renegotiated",
+    "text": "Backup frequency reduced after the recovery point objective was renegotiated with the service owner.",
+    "reference": "change-request-4610"
+  },
+  "controlCategories": ["data-protection", "change-approval"],
+  "metadata": {
+    "backup": {
+      "policyId": "backup-policy-orders",
+      "retentionClass": "operational-35-day",
+      "protectedScope": "database-orders"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/recovery-complete.json

@@ -0,0 +1,61 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-000f-7c4d-8b1e-2f3a4051620f",
+  "time": "2026-04-02T22:15:07.240Z",
+  "event": {
+    "name": "recovery.complete",
+    "category": "privileged-operation",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Disaster recovery for the payments platform closed after the failback was verified."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1180",
+    "tenantId": "tenant-7",
+    "roles": ["recovery-coordinator"]
+  },
+  "resource": {
+    "type": "service",
+    "id": "service-payments",
+    "name": "payments-platform",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "recovery-orchestrator",
+    "environment": "production",
+    "version": "1.8.3",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "recovery-2026-0402"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "disaster-recovery-runbook",
+    "policyVersion": "9"
+  },
+  "reason": {
+    "code": "recovery-verified",
+    "text": "The platform is serving from the primary region and the runbook's verification steps passed, so the recovery was closed.",
+    "reference": "incident-record-2214"
+  },
+  "controlCategories": ["recoverability", "privileged-access"],
+  "metadata": {
+    "backup": {
+      "recoveryId": "recovery-2026-0402-0311",
+      "recoveryPoint": "2026-04-02T21:40:00Z"
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/recovery-failback.json

@@ -0,0 +1,72 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-000e-7c4d-8b1e-2f3a4051620e",
+  "time": "2026-04-02T21:47:33.910Z",
+  "event": {
+    "name": "recovery.failback",
+    "category": "privileged-operation",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "Payments platform returned to the primary region once storage availability was restored."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1180",
+    "tenantId": "tenant-7",
+    "roles": ["recovery-coordinator"]
+  },
+  "resource": {
+    "type": "service",
+    "id": "service-payments",
+    "name": "payments-platform",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "recovery-orchestrator",
+    "environment": "production",
+    "version": "1.8.3",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "recovery-2026-0402"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "disaster-recovery-runbook",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-failover-authorization",
+    "requestId": "request-9347",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-02T21:41:00Z"
+  },
+  "reason": {
+    "code": "primary-region-restored",
+    "text": "Primary storage was restored and resynchronized, so traffic was returned to the primary region.",
+    "reference": "incident-record-2214"
+  },
+  "controlCategories": ["recoverability", "privileged-access"],
+  "metadata": {
+    "backup": {
+      "recoveryId": "recovery-2026-0402-0311",
+      "targetScope": "region-north-primary",
+      "recoveryPoint": "2026-04-02T21:40:00Z",
+      "approvalRequired": true,
+      "rehearsal": false
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/recovery-failover.json

@@ -0,0 +1,72 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-000b-7c4d-8b1e-2f3a4051620b",
+  "time": "2026-04-02T03:24:55.480Z",
+  "event": {
+    "name": "recovery.failover",
+    "category": "privileged-operation",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Payments platform failed over to the secondary region."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1180",
+    "tenantId": "tenant-7",
+    "roles": ["recovery-coordinator"]
+  },
+  "resource": {
+    "type": "service",
+    "id": "service-payments",
+    "name": "payments-platform",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "recovery-orchestrator",
+    "environment": "production",
+    "version": "1.8.3",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "recovery-2026-0402"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "disaster-recovery-runbook",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "workflow-failover-authorization",
+    "requestId": "request-9330",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-04-02T03:18:00Z"
+  },
+  "reason": {
+    "code": "regional-outage",
+    "text": "Traffic moved to the secondary region while primary storage is unavailable.",
+    "reference": "incident-record-2214"
+  },
+  "controlCategories": ["recoverability", "privileged-access"],
+  "metadata": {
+    "backup": {
+      "recoveryId": "recovery-2026-0402-0311",
+      "targetScope": "region-south-secondary",
+      "recoveryPoint": "2026-04-02T03:05:00Z",
+      "approvalRequired": true,
+      "rehearsal": false
+    }
+  }
+}

package/examples/profiles/backup-and-recovery/valid/recovery-start.json

@@ -0,0 +1,61 @@
+{
+  "specVersion": "0.1",
+  "id": "018f2a10-000a-7c4d-8b1e-2f3a4051620a",
+  "time": "2026-04-02T03:11:18.140Z",
+  "event": {
+    "name": "recovery.start",
+    "category": "privileged-operation",
+    "type": "execute",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Disaster recovery declared for the payments platform."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1180",
+    "tenantId": "tenant-7",
+    "roles": ["recovery-coordinator"]
+  },
+  "resource": {
+    "type": "service",
+    "id": "service-payments",
+    "name": "payments-platform",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-7"
+  },
+  "application": {
+    "name": "recovery-orchestrator",
+    "environment": "production",
+    "version": "1.8.3",
+    "region": "region-north"
+  },
+  "organization": {
+    "tenantId": "tenant-7"
+  },
+  "request": {
+    "correlationId": "recovery-2026-0402"
+  },
+  "authentication": {
+    "method": "mfa",
+    "mfa": true,
+    "assuranceLevel": "high"
+  },
+  "authorization": {
+    "decision": "allow",
+    "policy": "disaster-recovery-runbook",
+    "policyVersion": "9"
+  },
+  "reason": {
+    "code": "regional-outage",
+    "text": "The primary region lost storage availability; the recovery runbook was invoked.",
+    "reference": "incident-record-2214"
+  },
+  "controlCategories": ["recoverability", "privileged-access"],
+  "metadata": {
+    "backup": {
+      "recoveryId": "recovery-2026-0402-0311",
+      "recoveryPoint": "2026-04-02T03:05:00Z"
+    }
+  }
+}