Notifications
Clear all
Topic starter
19/08/2026 3:47 pm
TL;DR: Access control decisions can become high-value security telemetry when policy engines like Open Policy Agent emit structured allow and deny events, and Wazuh shows how those logs can be ingested, correlated, and paired with file integrity monitoring to spot policy drift and unauthorized changes, according to Wazuh. The practical issue is not policy evaluation itself but whether teams can observe and trust the policy layer when access decisions change.
NHIMG editorial — based on content published by Wazuh: how Wazuh analyses Open Policy Agent logs to turn access control activity into security telemetry
Questions worth separating out
Q: How should security teams monitor policy decisions from OPA in production?
A: Security teams should ingest decision logs into central monitoring, then build detections around repeated denials, unexpected allow paths, and unusual input combinations.
Q: Why do policy files need integrity monitoring as part of access governance?
A: Because the policy file is the rulebook that defines who can do what.
Q: What breaks when authorisation logs are not correlated with policy changes?
A: Investigators lose the ability to tell whether a change in access behaviour came from attacker activity, policy drift, or a legitimate rule update.
Practitioner guidance
- Monitor policy decisions as security events Ingest OPA allow and deny decisions into the SIEM or equivalent monitoring platform and create detections for repeated denials, unusual risk values, and access from unexpected roles or paths.
- Protect the policy store with file integrity monitoring Apply FIM to the directory that contains Rego policies so create, modify, and delete activity is alerted and reviewed before the new logic is trusted in production.
- Correlate policy changes with access anomalies Investigate denied or newly allowed requests in the same window as policy edits, because a change in access behaviour can reflect policy tampering rather than user behaviour.
What's in the full article
Wazuh's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step OPA and Wazuh configuration for logging and ingestion on Ubuntu 24.04
- Sample Rego policy files for admin, API, device, and IP-based access rules
- Custom Wazuh rule examples for OPA decision logs and policy file integrity events
- Dashboard filter steps for reviewing OPA and FIM alerts in the Wazuh console
👉 Read Wazuh's guide to analysing Open Policy Agent decision logs with Wazuh →
OPA decision logs and access control telemetry: what should teams monitor?
Explore further
19/08/2026 4:24 pm
Policy decision logs are becoming part of the identity evidence trail. The important shift in this pattern is that authorisation is no longer a silent yes-or-no control. Every denied request, unexpected risk score, or unusual input attribute can become audit evidence for identity, device, and network context. That is especially relevant where service accounts, APIs, and workload identities drive access decisions. Security teams should treat policy logs as a control record, not just application output.
A question worth separating out:
Q: What is the difference between monitoring access requests and monitoring policy decisions?
A: Monitoring access requests shows what users or workloads tried to do, while monitoring policy decisions shows how the authorisation engine evaluated those requests. Both are needed. Requests reveal intent and abuse patterns, but decisions reveal whether the control layer behaved as expected and whether policy changes altered the approval boundary.
👉 Read our full editorial: OPA decision logs turn access control into security telemetry
