[External Validation] security/security.siem_audit - security-ops

[tradecatlabs]

External Validation Work Item

• Work item: external-work.e90698a411fc18fe
• Domain: security
• Category: security.siem_audit
• Owner: security-ops
• Priority: P0
• Occurrences: external.9a1d8cdc68c7c9c9, external.a0cc7fd4426a24f2, external.d442a2783c511529

Required Credentials

• SIEM ingestion access
• SIEM workspace
• immutable audit storage proof
• immutable audit storage proof ref
• query proof owner approval

Required Evidence

• SIEM ingestion proof accepted
• immutable audit storage proof accepted

Operator Commands

• bash scripts/audit-handoff-dry-run.sh --bundle-json <audit-handoff-json> --bundle-markdown <audit-handoff-md> --output-dir <dry-run-dir>
• bash scripts/external-validation-proof-ref-gate.sh --work-queue-json <work-queue-json> --evidence-json <proof-ref-bundle-json> --output-json <proof-ref-gate-json>
• bash scripts/security-externalization-gate.sh --evidence-json <redacted-proof.json> --output-json <path>
• bash scripts/security-externalization-gate.sh --output-json <security-externalization-json>

Proof Ref Template

• Pattern: evidence://external-validation/security-siem-audit/<run-id>
• Artifact hash: sha256:<64 lowercase hex artifact digest>
• Verification command: bash scripts/external-validation-proof-ref-gate.sh --work-queue-json <work-queue-json> --evidence-json <proof-ref-bundle-json> --output-json <proof-ref-gate-json>

Blocking Items

• category_live_evidence_missing
• category_live_pending
• proof_ref_missing
• stale_owner_pending

Closure Condition

SIEM or immutable audit store ingestion, query and retention proof refs pass without raw log payload.

Non-Claims

• This issue does not prove live validation has passed.
• Do not paste token, secret, DSN, endpoint URL, chat id, user input, report body or production logs.