opschain admin siem

Included from Basic tier

Manage SIEM forwarder connections: the push half of the audit lane, streaming the event feed to a customer SIEM as a base capability (no entitlement gate). Each connection names a receiver and forwards every event — or an event-type prefix subset — with batched, at-least-once delivery behind a durable cursor:

• splunk_hec — Splunk HTTP Event Collector: JSON envelopes (sourcetype opschain:event, the catalogued event row as the event body) POSTed to the collector URL, authenticated by a write-only HEC token (encrypted at rest, never echoed by any read).
• syslog — CEF records (CEF:0|LimePoint|OpsChain|<version>|<event type>|...) over UDP, TCP or TLS (TLS verifies against the system roots), severity mapped from the event-type prefix (error 9, warn 6, audit 5, api 3, else 1).
• otlp_http — the correlation chain as OpenTelemetry traces over OTLP/HTTP (<endpoint>/v1/traces, protobuf or JSON): one trace per chain, a synthetic root span per chain named by its unit of work (change <id> / run <id>), a span per event with identifiers under opschain.* and the evidence-ledger anchor — to Grafana Tempo, Jaeger, an OpenTelemetry Collector or a governance tower's collector; the optional token (bearer or a named header) has the HEC token's write-only custody, TLS trust is --ssl-verify / --ssl-ca-cert. Usernames and emails are never attributes.

Delivery is at-least-once: a batch that the receiver refuses is retried with backoff and the cursor never advances past an unacknowledged event, so receivers dedup on the envelope's explicit event id (event.id / externalId, or the span ids derived from it). Delivery health — last delivered, lag behind the newest event, consecutive failures — rides on every read, and a sustained failure streak lands a throttled warn:siem:delivery_failing event.

Forwarded payloads carry only the catalogued event row and the fixed envelope — events are secret-free by the standing redaction rule, and the forwarder adds nothing beyond them; the trace lane carries identifiers from the row, never the username column or the data document.

Every verb sits behind the admin-plane authorization determination, and every write is audited (api:siem_connections:create|update|destroy|test).

Verbs

• opschain docs cli/admin-siem-list — the connection table with health.
• opschain docs cli/admin-siem-show — one connection in full.
• opschain docs cli/admin-siem-create — register a connection.
• opschain docs cli/admin-siem-update — change fields, rotate the token or replace the filter.
• opschain docs cli/admin-siem-delete — remove a connection.
• opschain docs cli/admin-siem-test — send one synthetic test event.