Architecture

Overview

Security Auditor is a Gateway-focused module. It observes selected Ignition activity, retains audit information locally within the Gateway environment, presents administrator pages, and can send configured notifications or reports outward.

flowchart LR
    A[Ignition sessions and projects] --> B[Security Auditor Gateway services]
    C[Gateway administrator] --> D[Configuration and Reports pages]
    D --> B
    B --> E[Local audit information]
    B --> F[Configured notifications and reports]
    B --> G[Protected archive before retention removal]

The diagram is conceptual. Actual data available to the module depends on the Gateway's active sessions, projects, user sources, and administrator configuration.

Ignition scope distribution

Gateway scope

Active module functionality is implemented in the Gateway scope. This includes monitoring, configuration, reporting, retention, user-facing Gateway pages, and communication with configured reporting destinations.

Designer scope

No dedicated Designer module functionality was identified. Designer activity can be observed where it appears as a Gateway-visible classic session.

Client / Vision scope

No dedicated Vision Client functionality or custom Vision component was identified. Classic client activity is observed from the Gateway.

Perspective session scope

No custom Perspective component is provided. The Gateway can observe Perspective session activity available to the module.

Major functional areas

Area	Public responsibility
Activity observation	Observes selected session and project activity.
Audit retention	Maintains module-local audit information for review and reporting.
Privileged access policy	Identifies configured role/user mismatches and can notify or apply an administrator-selected response.
Reporting	Presents report views and supports configured delivery.
Retention	Removes selected aged records and can require archive creation first.
Privacy presentation	Reduces exposure of personally identifiable values in module displays and reports when enabled.

Data flow

Relevant Gateway activity occurs.
The module observes the available event/session/project context.
Audit information is retained for review, reporting, and configured policy checks.
An administrator reviews information in the Gateway interface or configures delivery/retention behavior.
Where configured, the module sends notifications/reports or performs retention processing.

Lifecycle

When the module starts, it initializes its Gateway services, configuration, and local storage before beginning periodic observation and operational tasks. When it stops, active monitoring work is stopped cleanly. Retained configuration and audit information are intended to remain available when the module starts again.

An initialization problem can prevent normal data collection. Administrators should use the module's visible health/status information and Gateway logs to investigate such conditions.

External dependencies

Security Auditor relies on the Ignition Gateway and its configured user sources, email profiles, projects, and session services. External report/notification delivery requires administrator-provided destinations and the necessary Gateway network access.

The module does not establish a custom inbound service, custom device connection, or custom external database requirement.

Last updated: August 20, 2026