[I] Add a generic webhook event listener for audit/SIEM integration [polaris]

["vigneshio (via GitHub)" <gi...@apache.org>]

vigneshio opened a new issue, #5082:
URL: https://github.com/apache/polaris/issues/5082

   ### Is your feature request related to a problem? Please describe.
   
   Polaris has an event-listener framework with several built-in listeners, but the current push-style options don't cover a common operational need: shipping audit events to a generic HTTP endpoint.
   
   The available options today are:
   ```
   
   OpenTelemetry - requires deploying and operating an OTLP collector
   AWS CloudWatch - AWS-only
   In-memory buffer - stores events inside Polaris but does not push them
   Kafka (in progress) - requires a Kafka cluster
   ```
   
   Many SIEM and audit systems - Splunk HEC, Elasticsearch/Logstash[HTTP], Opensearch, Datadog, custom collectors - accept plain `HTTP + JSON` webhooks. A generic webhook listener would let operators stream Polaris events (catalog, principal, credential, task, rate-limiting, etc.) into these systems without extra infrastructure.
   
   ### Describe the solution you'd like
   
   Add a new event listener type webhook `(polaris.event-listener.types=webhook)` that:
   
   - POSTs each sanitized Polaris event as JSON to a configurable HTTP endpoint `(polaris.event-listener.webhook.endpoint)`
   - Optionally signs the payload with **HMAC-SHA256** using a shared secret `(polaris.event-listener.webhook.secret)`, sending the signature in the header`X-Polaris-Signature-256: sha256=<hex>` so receivers can verify authenticity and integrity
   - Retries failed deliveries (non-2xx responses or connection errors) with exponential backoff, then drops the event and logs an error
   - Only receives sanitized events _(no raw/credential data)_
   
   Configuration
   
   ```
   polaris.event-listener.types=webhook
   polaris.event-listener.webhook.endpoint=https://siem.example.com/events
   polaris.event-listener.webhook.secret=optional-hmac-secret
   polaris.event-listener.webhook.max-attempts=5
   polaris.event-listener.webhook.retry-backoff=1s
   ```
   
   ### Describe alternatives you've considered
   
   **Kafka and OpenTelemetry** are powerful, but both require additional infrastructure. A plain HTTP webhook is the lowest-friction option for teams that already have an `HTTP` ingestion endpoint in their SIEM / audit pipeline and just want Polaris events flowing into it with minimal operational overhead.. 
   
   ### Additional context
   
   _No response_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Add a generic webhook event listener for audit/SIEM integration [polaris]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on issue #5082:
URL: https://github.com/apache/polaris/issues/5082#issuecomment-5310937696

   This issue is stale because it has been open 30 days with no activity. Remove stale label or comment if you think it's still relevant.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Add a generic webhook event listener for audit/SIEM integration [polaris]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on issue #5082:
URL: https://github.com/apache/polaris/issues/5082#issuecomment-6244364269

   This issue is stale because it has been open 30 days with no activity. Remove stale label or comment if you think it's still relevant.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org