AWatch-rus/docs/dlp-policy-engine.md

DLP Policy Engine

Purpose

aw-server/dlp-policy-engine is the centralized policy lifecycle service for AWatch-rus endpoints.

It supports:

• full CRUD for policy documents;
• policy versioning in SQLite;
• approval workflow (draft -> pending_approval -> approved -> deployed);
• audit trail for every policy mutation;
• agent push/pull coordination (heartbeat + desired refresh hint).

Base URL

http://<aw-server>:5601

REST API

Health:

• GET /healthz

CRUD:

• GET /api/0/dlp/policies
• POST /api/0/dlp/policies
• GET /api/0/dlp/policies/{id}
• PUT /api/0/dlp/policies/{id}
• DELETE /api/0/dlp/policies/{id}

Active policy:

• GET /api/0/dlp/policies/active
• GET /api/0/dlp/policies/active/version
• POST /api/0/dlp/policies/rollback

Approval workflow:

• POST /api/0/dlp/policies/{id}/submit -> pending_approval
• POST /api/0/dlp/policies/{id}/approve -> approved
• POST /api/0/dlp/policies/{id}/draft -> draft
• POST /api/0/dlp/policies/{id}/activate -> deploy (allowed only from approved)

Audit:

• GET /api/0/dlp/policies/audit?limit=200
• GET /api/0/dlp/policies/{id}/audit?limit=200

Agent push/pull sync:

• POST /api/0/dlp/policies/agents/{agent_id}/heartbeat
• GET /api/0/dlp/policies/agents/{agent_id}/desired

Workflow Example

1. Create draft: POST /api/0/dlp/policies
2. Submit: POST /api/0/dlp/policies/{id}/submit
3. Approve: POST /api/0/dlp/policies/{id}/approve
4. Deploy: POST /api/0/dlp/policies/{id}/activate

Every step is written to policy_audit.

Deployment

• Service unit: aw-dlp-policy-engine.service
• DB path: AW_DLP_POLICY_ENGINE_DB_PATH
• Port: AW_DLP_POLICY_ENGINE_PORT (default 5601)
• Ansible role: ansible/roles/dlp-policy-engine/tasks/main.yml

Recommended server deploy:

ansible-playbook -i ansible/inventory.ini ansible/deploy_aw_server.yml