Compliance Reports

Sentinel can generate compliance reports for GDPR, PCI-DSS, and SOC 2 directly from your security data. Each report aggregates threat events, audit logs, user activity, and access control records into a structured document that maps to the requirements of its respective compliance framework. Reports are generated on demand through the API or the dashboard and can be exported as JSON for integration with external compliance tools.

Available Reports

Sentinel supports three compliance report types. Each report queries different subsets of stored data and presents metrics aligned with its compliance framework.

GDPR Report

The GDPR report provides visibility into how user data is accessed, exported, and deleted within your application. It also surfaces unusual access patterns detected by the anomaly detection engine. This helps demonstrate compliance with GDPR articles related to data subject rights, lawful processing, and breach notification.

Metrics

{
  "data": {
    "generated_at": "2025-06-15T10:00:00Z",
    "window_start": "2025-05-16T10:00:00Z",
    "window_end": "2025-06-15T10:00:00Z",
    "total_users": 42,
    "data_access_events": 1580,
    "data_export_events": 12,
    "data_deletion_events": 3,
    "unusual_access_patterns": [
      {
        "id": "te-anom-001",
        "timestamp": "2025-06-10T03:22:00Z",
        "ip": "198.51.100.14",
        "threat_types": ["AnomalyDetected"],
        "severity": "Medium"
      }
    ],
    "user_data_summary": [
      {
        "user_id": "user-abc123",
        "activity_count": 87,
        "routes_accessed": ["/api/users", "/api/profile"],
        "last_seen": "2025-06-15T09:45:00Z"
      }
    ]
  }
}

PCI-DSS Report

The PCI-DSS report focuses on authentication security, incident tracking, and threat blocking over a fixed 90-day window. It maps to PCI-DSS requirements around access control, monitoring, and incident response. The report includes a requirements status map that indicates whether each relevant PCI-DSS requirement is compliant, partially met, or non-compliant based on your Sentinel configuration and runtime data.

Metrics

{
  "data": {
    "generated_at": "2025-06-15T10:00:00Z",
    "auth_events_90d": 12450,
    "failed_logins_90d": 342,
    "security_incidents": 87,
    "blocked_threats": 76,
    "requirements": {
      "Req 1 - Firewall Configuration": "compliant",
      "Req 2 - Default Passwords": "compliant",
      "Req 6 - Secure Systems": "partial",
      "Req 7 - Access Control": "compliant",
      "Req 8 - Authentication": "compliant",
      "Req 10 - Logging & Monitoring": "compliant",
      "Req 11 - Security Testing": "partial",
      "Req 12 - Security Policy": "non-compliant"
    }
  }
}

SOC 2 Report

The SOC 2 report provides evidence for the Trust Services Criteria: security, availability, and confidentiality. It aggregates monitoring evidence, incident response metrics, access control data, and anomaly events into a format suitable for SOC 2 Type II audits.

Sections

Monitoring Evidence

Incident Response

Access Control

Anomalies

A list of anomaly-type threat events detected during the reporting window. Each anomaly includes the event ID, timestamp, source IP, severity, and threat type details.

{
  "data": {
    "generated_at": "2025-06-15T10:00:00Z",
    "window_start": "2025-05-16T10:00:00Z",
    "window_end": "2025-06-15T10:00:00Z",
    "monitoring_evidence": {
      "total_events": 58420,
      "threats_detected": 134,
      "threats_blocked": 121
    },
    "incident_response": {
      "total_incidents": 134,
      "resolved": 128,
      "avg_response_time": "4m32s"
    },
    "access_control": {
      "unique_users": 67,
      "auth_events": 8930,
      "ip_blocks_active": 14
    },
    "anomalies": [
      {
        "id": "te-anom-042",
        "timestamp": "2025-06-12T18:15:00Z",
        "ip": "203.0.113.88",
        "threat_types": ["AnomalyDetected"],
        "severity": "High"
      }
    ]
  }
}

API Endpoints

All report endpoints are authenticated. Include a valid JWT token in the Authorization header. Each endpoint returns the report data in a { "data": ... } envelope.

Time Windows

GDPR and SOC 2 reports accept a ?window query parameter that controls how far back the report looks. The value is a Go-style duration string. If omitted, the default is 720h (30 days).

Dashboard

The Sentinel dashboard includes a dedicated Reports page that provides a graphical interface for generating compliance reports without using the API directly.

• Report type selector -- choose between GDPR, PCI-DSS, and SOC 2 using toggle buttons at the top of the page.
• Date range picker -- select the time window from a dropdown. The dropdown is hidden for PCI-DSS since it always covers 90 days.
• Generate button -- click to generate the report on demand. A loading indicator is shown while the report is being computed.
• Structured display -- the report is rendered with summary statistics in a grid layout, followed by detailed sections (requirements status, user data summary, anomaly events, etc.) depending on the report type.
• JSON export -- an Export JSON button appears after a report is generated, allowing you to download the report data as a JSON file.

Access the Reports page at http://localhost:8080/sentinel/ui and navigate to the Reports section.

JSON Export

Both the dashboard and the API return reports as JSON. From the dashboard, clicking the Export JSON button downloads the report as a file named sentinel-<type>-report-<date>.json, where <type> is the report type (gdpr, pci-dss, or soc2) and <date> is the current date in YYYY-MM-DD format.

sentinel-gdpr-report-2025-06-15.json
sentinel-pci-dss-report-2025-06-15.json
sentinel-soc2-report-2025-06-15.json

When consuming reports programmatically via the API, pipe the response through jq to extract the .data field and redirect it to a file:

curl -s -H "Authorization: Bearer <token>" \
  "http://localhost:8080/sentinel/api/reports/gdpr?window=720h" \
  | jq '.data' > gdpr-report.json

Testing

Use the following curl commands to generate each report type. Replace <token> with a valid JWT token obtained from the dashboard login endpoint.

Generate GDPR Report

# GDPR report for the last 30 days (default)
curl -s -H "Authorization: Bearer <token>" \
  "http://localhost:8080/sentinel/api/reports/gdpr?window=720h" | jq .

# GDPR report for the last 7 days
curl -s -H "Authorization: Bearer <token>" \
  "http://localhost:8080/sentinel/api/reports/gdpr?window=168h" | jq .

# GDPR report for the last 90 days
curl -s -H "Authorization: Bearer <token>" \
  "http://localhost:8080/sentinel/api/reports/gdpr?window=2160h" | jq .

Generate PCI-DSS Report

# PCI-DSS report (always 90 days, no window parameter)
curl -s -H "Authorization: Bearer <token>" \
  "http://localhost:8080/sentinel/api/reports/pci-dss" | jq .

Generate SOC 2 Report

# SOC 2 report for the last 30 days (default)
curl -s -H "Authorization: Bearer <token>" \
  "http://localhost:8080/sentinel/api/reports/soc2?window=720h" | jq .

# SOC 2 report for the last 90 days
curl -s -H "Authorization: Bearer <token>" \
  "http://localhost:8080/sentinel/api/reports/soc2?window=2160h" | jq .

How It Works

Reports are generated on demand by the reports.Generator struct, which queries the storage layer for the relevant data. Each report type has a dedicated generator method that assembles data from multiple storage queries into a single response.

1. GDPR -- queries user activity, READ/DELETE audit logs, and anomaly-type threat events to build the user data access summary and unusual access patterns list.
2. PCI-DSS -- queries authentication audit logs, all threat events, and blocked threats over a fixed 90-day window. Computes failure rates and maps results to PCI-DSS requirement categories.
3. SOC 2 -- queries threat stats, the security score, resolved incidents, audit logs, blocked IPs, and anomaly events to build evidence across monitoring, incident response, and access control sections.

1// Generator produces compliance reports from stored Sentinel data.
2type Generator struct {
3    store storage.Store
4}
5
6// NewGenerator creates a new compliance report generator.
7func NewGenerator(store storage.Store) *Generator {
8    return &Generator{store: store}
9}
10
11// GenerateGDPR produces a GDPR compliance report for the given time window.
12func (g *Generator) GenerateGDPR(ctx context.Context, window time.Duration) (*GDPRReport, error) {
13    // Queries user activity, audit logs (READ/DELETE), and anomaly threats
14    // Returns structured report with per-user summaries
15}
16
17// GeneratePCIDSS produces a PCI-DSS compliance report for the last 90 days.
18func (g *Generator) GeneratePCIDSS(ctx context.Context) (*PCIDSSReport, error) {
19    // Fixed 90-day window, no configurable parameter
20    // Queries auth audit logs, all threats, and blocked threats
21}
22
23// GenerateSOC2 produces a SOC2 compliance report for the given time window.
24func (g *Generator) GenerateSOC2(ctx context.Context, window time.Duration) (*SOC2Report, error) {
25    // Queries threat stats, security score, resolved incidents,
26    // audit logs, blocked IPs, and anomaly events
27}

Next Steps

• Dashboard -- Access the Reports page and generate reports from the UI
• Anomaly Detection -- Powers the unusual access patterns in GDPR and anomalies in SOC 2 reports
• WAF -- Threat events from the WAF feed into PCI-DSS and SOC 2 incident data
• Auth Shield -- Authentication events that populate PCI-DSS auth metrics
• Security Score -- The security score is included in SOC 2 monitoring evidence
• Alerting -- Configure real-time alerts alongside periodic compliance reporting