{"id":8471,"library":"pycadf","title":"PyCADF Library","description":"The pycadf library provides an auditing data model based on the Cloud Auditing Data Federation (CADF) specification. It is primarily used within the OpenStack ecosystem to establish strict expectations for auditors regarding audit notifications and event structures. The library is actively maintained by the OpenStack project and is currently at version 4.0.1.","status":"active","version":"4.0.1","language":"en","source_language":"en","source_url":"https://github.com/openstack/pycadf","tags":["auditing","cloud","openstack","cadf","security","compliance"],"install":[{"cmd":"pip install pycadf","lang":"bash","label":"Install PyPI package"}],"dependencies":[{"reason":"Configuration management for OpenStack projects.","package":"oslo.config","optional":false},{"reason":"Serialization utilities for OpenStack projects.","package":"oslo.serialization","optional":false},{"reason":"PBR (Python Build Reasonableness) is an OpenStack project that provides a common build system.","package":"pbr","optional":false}],"imports":[{"symbol":"Event","correct":"from pycadf.events import Event"},{"symbol":"Resource","correct":"from pycadf.resource import Resource"},{"symbol":"CADF_VERSION_1_0_0","correct":"from pycadf.cadftype import CADF_VERSION_1_0_0"}],"quickstart":{"code":"import json\nfrom pycadf.events import Event\nfrom pycadf.resource import Resource\nfrom pycadf.cadftype import CADF_VERSION_1_0_0\n\n# Define initiator resource\ninitiator = Resource(\n    typeURI=CADF_VERSION_1_0_0 + 'security/account/user',\n    id='example-user-id',\n    name='example_auditor',\n    domainId='example-domain'\n)\n\n# Define target resource\ntarget = Resource(\n    typeURI=CADF_VERSION_1_0_0 + 'compute/instance',\n    id='example-instance-id',\n    name='my_vm',\n    host=Resource(\n        typeURI=CADF_VERSION_1_0_0 + 'compute/host',\n        id='example-host-id',\n        name='compute-host-1'\n    )\n)\n\n# Create a CADF event\nevent = Event(\n    eventType='activity',\n    outcome='success',\n    action='create',\n    initiator=initiator,\n    target=target,\n    eventTime='2026-04-16T15:00:00.000Z', # ISO 8601 format\n    id='example-event-id'\n)\n\n# Serialize the event to a dictionary and print as JSON\nprint(json.dumps(event.as_dict(), indent=2))","lang":"python","description":"This quickstart demonstrates how to create a basic CADF audit event by defining an initiator (user), a target (VM instance), and then constructing an Event object. The event is then serialized to a JSON string for auditing purposes."},"warnings":[{"fix":"Upgrade your Python environment to version 3.9 or higher. The officially supported minimum is Python 3.9.","message":"PyCADF version 4.0.0 and later no longer support Python 3.8. Users on Python 3.8 will encounter installation or runtime errors.","severity":"breaking","affected_versions":">=4.0.0"},{"fix":"Ensure that if you have specific versioning requirements for 'oslo' libraries in your project, they are compatible with the versions required by pycadf.","message":"As an OpenStack project, pycadf relies on common OpenStack libraries (oslo.config, oslo.serialization). While these are installed as dependencies, be aware of their presence if integrating pycadf into non-OpenStack environments.","severity":"gotcha","affected_versions":"All"}],"env_vars":null,"last_verified":"2026-04-16T00:00:00.000Z","next_check":"2026-07-15T00:00:00.000Z","problems":[{"fix":"Always provide all required arguments to the `Event` and `Resource` constructors. Consult the CADF specification or pycadf documentation for mandatory fields. For `Resource`, `typeURI` and `id` are crucial. For `Event`, `eventType`, `outcome`, `action`, `initiator`, `target`, `eventTime`, and `id` are common mandatory fields.","cause":"When creating a CADF Resource or Event, essential fields like 'typeURI' (for Resource) or 'eventType', 'outcome', 'action' (for Event) are mandatory and must be provided during instantiation.","error":"TypeError: __init__() missing 1 required positional argument: 'typeURI'"},{"fix":"Ensure `pycadf` is installed via `pip install pycadf`. Double-check the import statement for typos: `from pycadf.events import Event` and `from pycadf.resource import Resource` are the correct paths for core objects.","cause":"This error typically means the 'pycadf' package is either not installed, or there's a typo in the import path. The common root package for pycadf's modules is `pycadf`.","error":"ImportError: cannot import name 'Event' from 'pycadf.events'"},{"fix":"Refer to the CADF specification or the `pycadf.cadftaxonomy` module (e.g., `pycadf.cadftaxonomy.OUTCOME_TAXONOMY`) for valid values for 'outcome' ('success', 'failure', 'pending', 'unknown') and 'action'.","cause":"CADF events have a strict taxonomy for fields like 'outcome' and 'action'. Using values not defined in the CADF specification will lead to validation errors.","error":"ValueError: Invalid outcome 'fail'"}]}