13.3 SIEM export

Included from Basic tier

After this you can: push the event feed to Splunk or a CEF-speaking receiver, export correlation chains as OpenTelemetry traces, verify delivery, filter and watch connection health.

Before you start — tick each one:

• Lesson 5.1 — The record: events and chains (opschain learn 5.1)

In the GUI: the Operations area's Activity panel is the same stream the SIEM receives, and a sustained delivery failure lands there as warn:siem:delivery_failing; the connections are administered from the CLI.

"Can your evidence feed our SIEM?" — yes, as a base capability (no pack, no entitlement). The server pushes its event feed — every audited write, warning, approval and lifecycle event — to your SIEM with batched, at-least-once delivery behind a durable cursor, so your security team's alerting and retention see OpsChain without polling anything. This lesson registers one connection of each kind, proves delivery, narrows the filter and reads the health. The guide opschain docs getting-started/integrations-siem is the day-to-day reference; the component reference is opschain docs integrations-siem and every verb is on opschain docs cli/admin-siem.

You need admin rights on the OpsChain server and either a Splunk HEC token or a syslog receiver that accepts CEF.

1. Splunk, via HTTP Event Collector

Create an HEC token in Splunk (Settings → Data inputs → HTTP Event Collector), then register the connection — the token never rides the command line and no read ever returns it:

SPLUNK_HEC_TOKEN=... opschain admin siem create splunk-main \
  --kind splunk_hec \
  --endpoint-url https://splunk.example.com:8088/services/collector/event \
  --secret-env SPLUNK_HEC_TOKEN

Created SIEM connection splunk-main (splunk_hec -> https://splunk.example.com:8088/services/collector/event)

Events arrive with sourcetype=opschain:event; the event body is the catalogued event row (id, type, created_at, username, node_path, data) and nothing else. Dedup on event.id if your pipeline replays.

2. Anything CEF-speaking, via syslog

QRadar, ArcSight, Sentinel's syslog collector, rsyslog — point a syslog connection at it:

opschain admin siem create soc-syslog --kind syslog \
  --syslog-address siem.example.com:6514 --syslog-transport tls

Created SIEM connection soc-syslog (syslog -> tls://siem.example.com:6514)

Records are CEF:0|LimePoint|OpsChain|v5.7.0|<event type>|… with severity mapped from the event-type prefix (error 9, warn 6, audit 5, api 3) and the event id as externalId. TLS verifies against the system roots.

3. Traces, via OTLP/HTTP

The observability team asks a different question — "show me what the agent did as one trace". The same forwarder answers it: an otlp_http connection exports each correlation chain as one OpenTelemetry trace to Grafana Tempo, Jaeger, Datadog or any OpenTelemetry Collector (traces POST to <endpoint-url>/v1/traces). The token is optional — a bearer credential by default, or a tenant header with --auth-header — and has the HEC token's write-only custody:

TEMPO_TENANT=... opschain admin siem create tempo --kind otlp_http \
  --endpoint-url https://tempo.example.com:4318 \
  --auth-header X-Scope-OrgID --secret-env TEMPO_TENANT

Created SIEM connection tempo (otlp_http -> https://tempo.example.com:4318)

A chain arrives as one trace whose id is the correlation id's UUID bytes: a root span named by the unit of work (change <id> / run <id>), and one span per event (name = the event type) beneath it — or beneath the event that caused it, where the chain records one. Attributes are identifiers under opschain.* (opschain.event.type, .principal_id, .change_id, .run_id, .agent, model tokens on model-call events) and, for an event an attestation cites, the ledger anchor opschain.evidence.hash; usernames and emails are never attributes. A self-signed receiver takes --ssl-ca-cert (or --ssl-verify=false), and --protocol json serves a receiver without a protobuf path.

4. Verify delivery

test pushes one synthetic info:siem:test event through the connection's real sender:

opschain admin siem test splunk-main

Delivered a synthetic test event through splunk-main

A receiver that is not listening says so at once, and nothing is lost in the meantime — the cursor holds until the receiver acknowledges:

opschain admin siem test soc-syslog

Test delivery through soc-syslog FAILED: dial tcp 10.0.0.9:6514: connect: connection refused

5. Filter

The filter is a prefix list — forward only the security-relevant families, or leave it empty for everything:

opschain admin siem update splunk-main --event-filter 'warn:,error:,audit:'

Updated SIEM connection splunk-main

--event-filter replaces the stored filter; a supplied token rotates the stored one.

6. Watch

list and show carry per-connection health: when the receiver last acknowledged, how far delivery lags the newest event, and the failure streak:

opschain admin siem list

CODE         KIND        TARGET                                                FILTER       ENABLED  LAG  FAILURES
splunk-main  splunk_hec  https://splunk.example.com:8088/services/collector/…  warn:,error: yes      2s   -
soc-syslog   syslog      tls://siem.example.com:6514                           all events   yes      1s   -
tempo        otlp_http   https://tempo.example.com:4318                        all events   yes      3s   -

opschain admin siem show soc-syslog

Code:             soc-syslog
Id:               01a2fc00-…
Display name:     -
Kind:             syslog
Target:           tls://siem.example.com:6514
Event filter:     all events
HEC token:        -
Enabled:          yes
Last delivered:   2026-10-27T14:20:31Z
Lag:              1s
Failures:         -

A receiver outage loses nothing — batches retry with backoff and the cursor advances only when acknowledged — and a sustained streak lands a throttled warn:siem:delivery_failing event you can route to a watch or a mandate (lessons 5.5 and 11.4). Disabling a connection pauses its cursor in place for a later resume; deleting it removes the cursor.

Check yourself

• What delivery guarantee does the export make, and what holds the place of the last acknowledged event? Then: which two columns of opschain admin siem list tell you a receiver has gone quiet?

What you learned

• SIEM export is base: a Splunk HEC, CEF-over-syslog or OTLP/HTTP trace connection, token vaulted, registered in one command.
• An otlp_http connection shows each correlation chain as one trace — identifiers only, never usernames — in Tempo, Jaeger or any collector.
• Delivery is batched and at-least-once behind a durable cursor; an outage loses nothing and a sustained failure is a loud event.
• test proves the sender, --event-filter narrows the families, and list/show carry lag and failure streak per connection.

Next: this closes the module Integrations — back to your track (opschain learn).