Hardening HashiCorp Vault for Zero Trust: Audit Log Analysis

Act as a SIEM Integration Specialist and Threat Hunter. Design a highly aggressive monitoring and incident response architectural framework focused entirely on parsing HashiCorp Vault's raw, JSON-formatted audit logs to instantly detect fatal Zero Trust violations. Configure the Vault environment to securely and reliably stream un-dropped audit logs directly to the [SIEM_TOOL] (e.g., Splunk, Datadog, or Elastic). You must mathematically define three highly specific, complex SIEM detection rules engineered to identify the behavioral signatures of a [THREAT_ACTOR_PROFILE] (e.g., an Insider Threat executing rapid, sequential token creation, or a compromised CI/CD pipeline attempting unusual policy enumeration across paths it shouldn't know exist). Establish a strict cryptographic [RETENTION_PERIOD] for forensic compliance, and architect an automated webhook orchestration strategy capable of instantaneously revoking and blacklisting compromised Vault tokens without human intervention.