SOC Team
Evidence, not promises.
You watch the system, investigate incidents, and answer to auditors. Primebrick gives you a tamper-evident audit trail, field-level access reviews, real-time security signals, and downloadable compliance evidence with file:line references — not marketing claims.
What changes for you
Tamper-evident audit logs
Every entity change is logged with actor, timestamp, before/after values, trace ID and session ID. Audit fields are enforced by the framework's @Auditable decorator, not by a developer's memory. The log is append-only and hash-chained, so tampering is detectable.
Field-level access reviews
RBAC and schema-level permissions are discoverable and reviewable. See exactly who can read and write which field, and remove access with confidence, not guesswork. The RBAC map is generated from the @RBAC decorators in the code — not maintained in a separate spreadsheet that drifts from reality.
Real-time security signals
OpenTelemetry traces, structured logs and health checks give the SOC team live visibility into what the system is doing. Correlate a user action across frontend, backend, microservices and database in one trace — no log stitching, no timestamp correlation.
Downloadable compliance evidence
ISO 27001, NIS2 and OWASP mappings ship with file:line references as PDF reports — ready for auditors. Generated from real scan data on every build, not from a self-assessment spreadsheet someone updated last quarter. The report is reproducible: same code, same report.
Step-up authentication for sensitive operations
MFA and passkeys are built in, and privileged actions can require step-up authentication — a fresh MFA challenge before the operation is allowed. Password changes, RBAC modifications, credit limit increases: all gated by a fresh factor, not just the session cookie.
Anomaly detection and alerting
Failed logins, unusual access patterns, privilege escalations and geographic anomalies are detected and flagged automatically. Repeated failures trigger an auto-block. The SOC team sees alerts in real time, with the full trace context attached.
Incident response with full context
A single trace ID follows an incident from the browser alert through the API, the database query, and the audit log entry. No log stitching across servers, no timestamp correlation across time zones. You open the trace, you see the whole story, you write the postmortem.
Access reviews without a spreadsheet
The RBAC map is generated from the code, so it's always current. When the auditor asks "who can change the credit limit field?", you open the RBAC review panel and show them. No spreadsheet to maintain, no "I'll update it next week," no drift.
Incident response workflow
Detect
Anomaly alert fires. Auto-block kicks in for repeated failures.
Trace
Open the trace ID from the alert. See browser → API → DB in one view.
Investigate
Cross-reference the audit log entry with the same trace ID. Full context.
Remediate
Revoke access, rotate keys, block IP. All actions are themselves audited.
Report
Export the trace, the audit entries and the compliance status as a single PDF.
Compliance report sample
ISO 27001 · Annex A.5.15 — Access control Status: PASS Evidence: src/modules/customers/customer.entity.ts:14 @RBAC({ read: ['admin', 'sales'], write: ['admin'] }) NIS2 · Art. 21(2)(d) — Access control & management Status: PASS Evidence: src/modules/auth/rbac.guard.ts:8 MFA enforced on privileged roles OWASP · A01:2021 — Broken Access Control Status: PASS Evidence: src/sdk/permissions.check.ts:22 Every route guarded by RBAC decorator
Capabilities you'll use
We used to spend two weeks before every audit updating spreadsheets that were already out of date. Now we download a PDF from the last build and forward it. The first time I handed the auditor a file:line report, they asked me if it was real.
SOC Team FAQ
How tamper-evident are the audit logs really?
Each audit entry includes a hash of the previous entry, forming a chain. Changing an old entry breaks the chain and is immediately detectable. The log is append-only — no UPDATE or DELETE is allowed on the audit table, enforced at the database level. You can verify the chain integrity at any time with a built-in command.
Can we export the audit log to our SIEM?
Yes. The audit log is a standard Postgres table, and entries are also emitted as structured JSON logs that any SIEM (Splunk, Elastic, Datadog, Loki) can ingest. The trace IDs in the audit entries match the trace IDs in OpenTelemetry, so you can correlate audit events with distributed traces.
What compliance frameworks are supported out of the box?
ISO 27001 (Annex A controls), NIS2 (Article 21(2) measures), OWASP Top 10 and OWASP ASVS Level 2 ship with the scanner. GDPR data subject rights are supported via the audit log. The control catalog is extensible — you can add your own internal policies.
How does step-up authentication work for sensitive operations?
You mark an operation as "sensitive" in the entity or route definition. When a user attempts it, the framework checks whether they have completed an MFA challenge within a configurable window. If not, it issues a step-up challenge — a passkey or TOTP prompt — before allowing the operation. The challenge and the operation are both logged in the audit trail.
Can we customize the anomaly detection rules?
Yes. The default rules cover failed login bursts, geographic anomalies, privilege escalations and unusual access patterns. You can add custom rules based on your business logic. Rules are defined in code, versioned, and visible in the compliance report.
Visionary Entrepreneur
Turn the idea into infrastructure.
Developer
Ship code, not ceremony.
Want the evidence package?
See the audit, compliance and observability docs in detail. Or book a session — we'll run the scanner on a sample app live.