Identity at the client side layer

# ABOUTME: auditd rules for agent process startup. Drop in /etc/audit/rules.d/ and reload with augenrules --load.
# ABOUTME: Watches by absolute path; if the agent binary is moved or symlinked elsewhere the rule misses, so re-audit periodically.

# Watch for execve of any agent binary. The -k tag is what audit search uses.
-a always,exit -F arch=b64 -S execve -F path=/usr/local/bin/claude -k agent_exec
-a always,exit -F arch=b64 -S execve -F path=/usr/local/bin/agent-bwrap -k agent_exec
-a always,exit -F arch=b64 -S execve -F path=/usr/local/bin/mcp-launch -k agent_exec

# Watch for credential file reads (ACL should already deny these to the agent
# user, but a rule on the file detects attempts).
-w /etc/agents/ -p ra -k agent_credential_access

# Watch for hook config edits.
-w /etc/agents/hooks/ -p wa -k hook_config_edit
-w /etc/agents/mcp-allowlist.json -p wa -k allowlist_edit

# Watch for --no-verify in any process arg (the agent attempting to bypass
# pre-commit). The short form -n is also caught by the second rule.
-a always,exit -F arch=b64 -S execve -F a1=*--no-verify* -k git_no_verify
-a always,exit -F arch=b64 -S execve -F a1=*-n* -k git_short_no_verify

#!/usr/bin/env bash
# ABOUTME: PreToolUse hook that emits a structured JSON identity event to local syslog. Designed to chain ahead of pre_tool_use.sh.
# ABOUTME: Hashes the credential before logging; never logs the raw token.

set -euo pipefail

INPUT="$(cat)"
SESSION_ID="$(echo "$INPUT" | jq -r '.session_id // "unknown"')"
TOOL_NAME="$(echo "$INPUT" | jq -r '.tool_name // "unknown"')"
TOOL_INPUT="$(echo "$INPUT" | jq -r '.tool_input.command // ""')"

# Hash the credential. Truncate to 16 hex chars (64 bits) -- long enough that
# collisions across the agent population are negligible, short enough not to
# reveal the full hash in logs.
CRED_HASH="$(printf '%s' "${ANTHROPIC_API_KEY:-}" | sha256sum | cut -d' ' -f1 | head -c 16)"
EFFECTIVE_UID="$(id -u)"
HOSTNAME="$(hostname -f 2>/dev/null || hostname)"
TIMESTAMP="$(date -Iseconds)"

EVENT="$(jq -n \
  --arg session "$SESSION_ID" \
  --arg tool "$TOOL_NAME" \
  --arg input "$TOOL_INPUT" \
  --arg cred "$CRED_HASH" \
  --argjson uid "$EFFECTIVE_UID" \
  --arg host "$HOSTNAME" \
  --arg ts "$TIMESTAMP" \
  '{event: "identity", session: $session, tool: $tool, input: $input, cred_fingerprint: $cred, uid: $uid, host: $host, ts: $ts}')"

logger -t agent-sentinel -p user.info "$EVENT"

# Pass the original input through to the next hook in the chain. PreToolUse
# hooks are expected to echo the input for downstream consumers.
echo "$INPUT"
exit 0

# ABOUTME: Vector config that ingests local syslog and ships parsed agent-sentinel events to Elasticsearch.
# ABOUTME: Substitute siem.example.com and SIEM_TOKEN. Vector 0.40+ required for the parse_json! built-in used here.

[sources.syslog_local]
type = "syslog"
mode = "tcp"
address = "127.0.0.1:6514"
max_length = 102400

[transforms.parse_agent]
type = "remap"
inputs = ["syslog_local"]
source = '''
  # Only process events tagged "agent-sentinel".
  if .appname != "agent-sentinel" {
    abort
  }
  parsed, err = parse_json(.message)
  if err != null {
    .parse_error = err
  } else {
    . = merge(., parsed)
  }
  .source = "agent-sentinel"
  .ingested_at = now()
'''

# Drop events that failed to parse so we don't pollute the index. The parse
# error is logged at WARN by Vector's internal stats.
[transforms.drop_unparsed]
type = "filter"
inputs = ["parse_agent"]
condition = '''
  exists(.event)
'''

[sinks.siem]
type = "elasticsearch"
inputs = ["drop_unparsed"]
endpoints = ["https://siem.example.com:9200"]
mode = "bulk"
bulk.index = "agent-sentinel-%Y.%m.%d"

[sinks.siem.auth]
strategy = "bearer"
token = "${SIEM_TOKEN}"

# Ship to a local file as a backstop in case the SIEM is unreachable.
# Vector buffers and replays automatically, but this gives us a last-resort
# audit trail on the operator host itself.
[sinks.local_archive]
type = "file"
inputs = ["drop_unparsed"]
path = "/var/log/agent-sentinel/%Y-%m-%d.jsonl"
encoding.codec = "json"
compression = "gzip"