AuditBridge reads NetBird audit events and delivers them independently to Grafana Loki, Wazuh, and generic HTTP or syslog destinations. It is a small Rust service for security monitoring, compliance evidence, and incident response.
flowchart LR
NetBird[NetBird audit API] --> AuditBridge[AuditBridge]
AuditBridge --> Loki[Grafana Loki]
AuditBridge --> Wazuh[Wazuh syslog]
AuditBridge --> HTTP[HTTP or syslog sink]
Get a NetBird access token (Team > create a Service User > create an access token, see Installation for exact steps), store it in a file, then run a released immutable image:
echo "nbp_your_token_here" > netbird-token
chmod 600 netbird-token
docker run -d --rm --name auditbridge \
-v "$PWD/netbird-token:/run/secrets/netbird-token:ro" \
-e NETBIRD_API_TOKEN_FILE=/run/secrets/netbird-token \
-e LOKI_URL=https://loki.example.com \
-p 9090:9090 \
ghcr.io/onelrian/auditbridge:<immutable-tag>Warning
Replace <immutable-tag> with a released application version. Do not use
latest in a production deployment, it moves whenever a new release ships.
Confirm it's running: docker logs auditbridge and curl http://localhost:9090/healthz.
| Need | Guide |
|---|---|
| Deploy with Docker, Compose, Kubernetes, or Helm | Installation |
| Configure secrets, retries, cursors, and metrics | Configuration |
| Deliver to Loki, Wazuh, HTTP, or syslog | Sinks |
| Monitor and troubleshoot the service | Operations |
| Develop and submit changes | Contributing |
| Report vulnerabilities | Security |
| Get help or report a defect | Support |
AuditBridge serves /healthz, /readyz, and /metrics on METRICS_PORT
(default 9090). Readiness requires a successful NetBird fetch and delivery to
at least one configured sink. See Operations for metric
names and troubleshooting.
The screenshots below are real output from a live run: real Loki, a real syslog receiver, and AuditBridge's actual binary, with only the upstream NetBird API stubbed to fixed sample data (no live account involved).
Tip
Don't take the screenshots' word for it: examples/local-demo/ reproduces
this exact setup with one docker compose up. See
examples/local-demo/README.md.
Distributed under the MIT License. See LICENSE.