Streaming Security Audit Trail with Apache Iceberg

Connect RisingWave CDC sources to your databases to capture every change event. Create Kafka sources for authentication and access events. Define SQL stream-table joins to enrich raw events with user and resource context. Create an Iceberg sink to write enriched records to S3-backed Iceberg tables. Query the audit trail via Spark or Trino for historical compliance evidence. RisingWave handles continuous ingestion and enrichment; Iceberg provides the immutable, snapshot-versioned storage.

Apache Iceberg maintains a snapshot history of every write batch. Use a compatible query engine such as Spark or Trino to query the Iceberg audit table at a specific snapshot, reconstructing exactly what the audit log contained at any point in the compliance period. RisingWave writes audit records continuously; the historical query runs against the Iceberg table from whichever engine your data platform uses.

Database triggers write audit records in the same transaction as the change, adding latency to every write and creating a failure mode where the trigger prevents the change. RisingWave CDC reads from the database replication log after the transaction commits, adding no write latency and no failure risk to the source database. CDC captures all changes regardless of application code, while triggers can be bypassed by direct database access.

Yes. RisingWave can ingest CDC streams from multiple PostgreSQL and MySQL databases simultaneously and join them with Kafka event streams from authentication systems, API gateways, and security tools. A single SQL materialized view can combine events from all sources into a unified audit record before writing to Iceberg, producing a cross-system audit trail in one table.