Download the PHP package litesoc/litesoc-php without Composer
On this page you can find all versions of the php package litesoc/litesoc-php. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download litesoc/litesoc-php
More information about litesoc/litesoc-php
Files in litesoc/litesoc-php
Package litesoc-php
Short Description Official PHP SDK for LiteSOC - Security event tracking and threat detection
License MIT
Homepage https://www.litesoc.io
Informations about the package litesoc-php
LiteSOC PHP SDK
Official PHP SDK for LiteSOC - Security event tracking and threat detection for your applications.
Installation
Quick Start
Features
- ✅ 26 standard security event types - Authentication, authorization, admin, data, and security events
- ✅ Management API - Query alerts and events programmatically (Business/Enterprise plans)
- ✅ Custom exceptions - Specific exceptions for auth, rate limits, and plan restrictions
- ✅ Automatic batching - Events are batched for efficient delivery
- ✅ Batch ingestion helper -
trackBatch()sends up to 100 events in a single request - ✅ Retry logic - Failed events are automatically retried
- ✅ Laravel integration - Service provider, facade, and config publishing
- ✅ PHP 8.2+ - Modern PHP with full type declarations
- 🗺️ GeoIP Enrichment - Automatic location data from IP addresses
- 🛡️ Network Intelligence - VPN, Tor, Proxy & Datacenter detection
- 📊 Threat Scoring - Auto-assigned severity (Low → Critical)
Security Intelligence (Automatic Enrichment)
When you provide user_ip, LiteSOC automatically enriches your events with:
🗺️ Geolocation
- Country & City resolution
- Latitude/Longitude coordinates
- Interactive map visualization in dashboard
🛡️ Network Intelligence
- VPN Detection - NordVPN, ExpressVPN, Surfshark, etc.
- Tor Exit Nodes - Anonymizing network detection
- Proxy Detection - HTTP/SOCKS proxy identification
- Datacenter IPs - AWS, GCP, Azure, DigitalOcean, etc.
📊 Threat Scoring
Events are auto-classified by severity:
- Low - Normal activity
- Medium - Unusual patterns
- High - Suspicious behavior
- Critical - Active threats (triggers instant alerts)
Important: Always include
user_ipfor full Security Intelligence features.
Configuration Options
Tracking Events
Basic Usage
Batch Ingestion with trackBatch (v2.5.0+)
To reduce HTTP overhead and align with the backend batch ingestion contract, you can send up to 100 events in a single call:
Using Event Type Constants
Using SecurityEvents Class
With Severity Level
With Metadata
Convenience Methods
The SDK provides convenience methods for common security events:
Laravel Integration
Installation
The package auto-discovers the service provider and facade.
Configuration
Publish the config file:
Add your API key to .env:
Usage with Facade
Usage with Dependency Injection
Event Listener Integration
Middleware for Auth Events
Event Types
26 Standard Events (Primary)
These are the primary events for comprehensive security coverage:
| Category | Event Type | Description |
|---|---|---|
| Auth | auth.login_success |
Successful user login |
| Auth | auth.login_failed |
Failed login attempt |
| Auth | auth.logout |
User logout |
| Auth | auth.password_reset |
Password reset completed |
| Auth | auth.mfa_enabled |
MFA enabled on account |
| Auth | auth.mfa_disabled |
MFA disabled on account |
| Auth | auth.session_expired |
Session timeout/expiry |
| Auth | auth.token_refreshed |
Token refresh |
| Authz | authz.role_changed |
User role modified |
| Authz | authz.permission_granted |
Permission assigned |
| Authz | authz.permission_revoked |
Permission removed |
| Authz | authz.access_denied |
Access denied event |
| Admin | admin.privilege_escalation |
Admin privilege escalation |
| Admin | admin.user_impersonation |
Admin impersonating user |
| Admin | admin.settings_changed |
System settings modified |
| Admin | admin.api_key_created |
New API key generated |
| Admin | admin.api_key_revoked |
API key revoked |
| Admin | admin.user_suspended |
User account suspended |
| Admin | admin.user_deleted |
User account deleted |
| Data | data.bulk_delete |
Bulk data deletion |
| Data | data.sensitive_access |
PII/sensitive data accessed |
| Data | data.export |
Data export operation |
| Security | security.suspicious_activity |
Suspicious behavior detected |
| Security | security.rate_limit_exceeded |
Rate limit triggered |
| Security | security.ip_blocked |
IP address blocked |
| Security | security.brute_force_detected |
Brute force attack detected |
Extended Events (Backward Compatible)
Additional events for granular tracking:
auth.password_changed,auth.password_reset_requested,auth.mfa_challenge_success,auth.mfa_challenge_failed,auth.session_createduser.created,user.updated,user.deleted,user.email_changed,user.profile_updatedauthz.role_assigned,authz.role_removed,authz.access_grantedadmin.invite_sent,admin.invite_accepted,admin.member_removeddata.import,data.bulk_update,data.download,data.upload,data.sharedsecurity.ip_unblocked,security.account_locked,security.impossible_travel,security.geo_anomalyapi.key_used,api.rate_limited,api.error,api.webhook_sent,api.webhook_failedbilling.subscription_created,billing.subscription_cancelled,billing.payment_succeeded,billing.payment_failed
Queue Management
Management API (Business/Enterprise)
The Management API allows you to query alerts and events programmatically. Requires a Business or Enterprise plan.
API Endpoints: These methods interact with
/api/v1/alertsand/api/v1/events
Get Alerts
Get Single Alert
Resolve Alert
Get Events
Get Single Event
Plan Awareness & Quota Headers
The SDK automatically captures plan and quota information from API response headers:
Response Metadata
After any Management API call, you can access plan information:
Headers Parsed
| Header | Property | Description |
|---|---|---|
X-LiteSOC-Plan |
plan |
Current plan name (starter, business, enterprise) |
X-LiteSOC-Retention |
retentionDays |
Data retention period in days |
X-LiteSOC-Cutoff |
cutoffDate |
Earliest accessible data timestamp |
ResponseMetadata Class
Plan-Restricted Features (403 Handling)
When accessing features that require a higher plan, the SDK throws PlanRestrictedException:
Exception Handling
The SDK provides specific exceptions for different error scenarios:
Exception Hierarchy
Error Handling (Silent Mode)
By default, the SDK fails silently (silent => true). To catch errors:
Debug Mode
Enable debug logging to troubleshoot issues:
For Laravel, set in your .env:
Non-Blocking / Async Usage
By default, the SDK is synchronous - HTTP requests block until complete. However, the SDK has safeguards:
- Silent mode (
silent => truedefault): Errors are logged, not thrown - Timeout (
timeout => 30.0default): Prevents indefinite blocking - Batching: Reduces number of HTTP calls
True Non-Blocking with fastcgi_finish_request()
For PHP-FPM environments (Laravel, Symfony, etc.), you can achieve true non-blocking behavior by sending the response to the client before flushing events:
Laravel Middleware for Non-Blocking Flush
Create a middleware that flushes events after the response is sent:
Laravel Queued Jobs (Recommended for High-Traffic)
For high-traffic applications, dispatch events to a queue:
API Reference
Event Collection API (/api/v1/collect)
| Method | Description |
|---|---|
track($eventName, $options) |
Queue a security event for sending |
trackLoginFailed($actorId, $options) |
Track failed login attempt |
trackLoginSuccess($actorId, $options) |
Track successful login |
trackPrivilegeEscalation($actorId, $options) |
Track privilege escalation (critical) |
trackSensitiveAccess($actorId, $resource, $options) |
Track sensitive data access |
trackBulkDelete($actorId, $recordCount, $options) |
Track bulk deletion operation |
trackRoleChanged($actorId, $oldRole, $newRole, $options) |
Track role/permission changes |
trackAccessDenied($actorId, $resource, $options) |
Track access denied events |
flush() |
Send all queued events immediately |
shutdown() |
Graceful shutdown with flush |
Events API (/api/v1/events)
| Method | Description |
|---|---|
getEvents($limit, $filters) |
List events with pagination |
getEvent($eventId) |
Get single event by ID |
Filters for getEvents():
event_name- Filter by event type (e.g.,auth.login_failed)actor_id- Filter by actor IDseverity- Filter by severity:critical,warning,infooffset- Pagination offset (default: 0)
Alerts API (/api/v1/alerts)
| Method | Description |
|---|---|
getAlerts($filters) |
List alerts with pagination |
getAlert($alertId) |
Get single alert by ID |
resolveAlert($alertId, $resolutionType, $notes) |
Mark alert as resolved |
markAlertSafe($alertId, $notes) |
Mark alert as safe/false positive |
Filters for getAlerts():
severity- Filter by severity:critical,warning,infostatus- Filter by status:active,resolved,safealert_type- Filter by type:impossible_travel,brute_force, etc.limit- Results per page (default: 20, max: 100)offset- Pagination offset (default: 0)
Resolution Types for resolveAlert():
blocked_ip- IP address was blockedblocked_user- User account was blockedfalse_positive- Alert was a false positiveinvestigated- Investigated, no action neededother- Other resolution
License
MIT License - see LICENSE for details.