Skip to main content
Version: v5.7.0

SIEM export — feeding Splunk, syslog/CEF and OpenTelemetry trace receivers

Included from Basic tier

"Can your evidence feed our SIEM?" — yes, as a base capability (no pack, no entitlement). The server pushes its event feed — every audited write, warning, approval and lifecycle event — to your SIEM with batched, at-least-once delivery behind a durable cursor, so your security team's alerting and retention see OpsChain without polling anything; the same forwarder exports each correlation chain as one OpenTelemetry trace to Grafana Tempo, Jaeger or any OTLP collector. The full reference is opschain docs integrations-siem.

1. Splunk, via HTTP Event Collector​

Create an HEC token in Splunk (Settings → Data inputs → HTTP Event Collector), then register the connection — the token never rides the command line and no read ever returns it:

SPLUNK_HEC_TOKEN=... opschain admin siem create splunk-main \
  --kind splunk_hec \
  --endpoint-url https://splunk.example.com:8088/services/collector/event \
  --secret-env SPLUNK_HEC_TOKEN
Created SIEM connection splunk-main (splunk_hec -> https://splunk.example.com:8088/services/collector/event)

Events arrive with sourcetype=opschain:event; the event body is the catalogued event row (id, type, created_at, username, node_path, data) and nothing else. Dedup on event.id if your pipeline replays.

2. Anything CEF-speaking, via syslog​

QRadar, ArcSight, Sentinel's syslog collector, rsyslog — point a syslog connection at it:

opschain admin siem create soc-syslog --kind syslog \
  --syslog-address siem.example.com:6514 --syslog-transport tls

Records are CEF:0|LimePoint|OpsChain|<version>|<event type>|… with severity mapped from the event-type prefix (error 9, warn 6, audit 5, api 3) and the event id as externalId.

3. Traces, via OTLP/HTTP​

Grafana Tempo, Jaeger, Datadog, an OpenTelemetry Collector in front of a governance tower — point an otlp_http connection at the receiver's base URL (traces POST to /v1/traces); the optional token rides as a bearer credential or in a named tenant header, with the same write-only custody:

TEMPO_TENANT=... opschain admin siem create tempo --kind otlp_http \
  --endpoint-url https://tempo.example.com:4318 \
  --auth-header X-Scope-OrgID --secret-env TEMPO_TENANT
Created SIEM connection tempo (otlp_http -> https://tempo.example.com:4318)

Each correlation chain arrives as one trace: a root span named by its unit of work (change <id> / run <id>), one span per event (name = the event type) under it — or under the event that caused it where the chain records one — with identifiers under opschain.* (opschain.event.type, .principal_id, .change_id, .run_id, .agent, model tokens on model-call events) and, for events an attestation cites, the ledger anchor opschain.evidence.hash. Usernames and emails are never attributes. Search the trace by the chain's correlation id: the trace id is its UUID bytes.

4. Verify, filter, watch​

opschain admin siem test splunk-main          # one synthetic info:siem:test event
opschain admin siem list                      # kind, target, filter, lag, failures
opschain admin siem update splunk-main --event-filter 'warn:,error:,audit:'

The filter is a prefix list — forward only the security-relevant families, or leave it empty for everything. list/show carry per-connection health: when the receiver last acknowledged, how far delivery lags the newest event, and the failure streak. A receiver outage loses nothing — batches retry with backoff and the cursor holds until acknowledged — and a sustained streak lands a throttled warn:siem:delivery_failing event you can route to notifications (opschain docs cli/admin-siem for every verb).