opschain admin siem create

Included from Basic tier

Registers a SIEM forwarder connection. The code and --kind are immutable after create; everything else can change through the update verb. The delivery cursor seeds at the newest event, so history is never replayed against connections created later — forwarding begins with the next event.

The receiver token is write-only: supply it through --secret-env (the name of an environment variable holding it) or --secret-prompt (a no-echo prompt), never on the command line; it is encrypted at rest and no read ever returns it. splunk_hec requires it (the HEC token); otlp_http takes it optionally (a bearer token, or a tenant header's value with --auth-header); syslog refuses it.

SPLUNK_HEC_TOKEN=... opschain admin siem create splunk-main \
  --kind splunk_hec \
  --endpoint-url https://splunk.example.com:8088/services/collector/event \
  --secret-env SPLUNK_HEC_TOKEN --event-filter 'warn:,error:,audit:'
Created SIEM connection splunk-main (splunk_hec -> https://splunk.example.com:8088/services/collector/event)

opschain admin siem create soc-syslog --kind syslog \
  --syslog-address siem.example.com:6514 --syslog-transport tls
Created SIEM connection soc-syslog (syslog -> tls://siem.example.com:6514)

TEMPO_TENANT=... opschain admin siem create tempo --kind otlp_http \
  --endpoint-url https://tempo.example.com:4318 \
  --auth-header X-Scope-OrgID --secret-env TEMPO_TENANT
Created SIEM connection tempo (otlp_http -> https://tempo.example.com:4318)

An otlp_http connection exports each correlation chain as one OpenTelemetry trace to <endpoint-url>/v1/traces — the mapping (trace and span id derivation, the root span per chain, the opschain.* attributes, the evidence anchor) is on opschain docs integrations-siem.

Flags

Flag	Meaning
--kind <kind>	Receiver kind: splunk_hec, syslog or otlp_http. Required, immutable.
--endpoint-url <url>	splunk_hec: the HEC collector URL (http or https). otlp_http: the receiver's base URL (/v1/traces is appended, e.g. https://tempo.example.com:4318).
--secret-env <name>	Name of an environment variable holding the receiver token — the Splunk HEC token, or the OTLP bearer/header token (never pass the value itself on the command line).
--secret-prompt	Prompt for the receiver token without echo (reads a line from stdin when piped).
--syslog-address <host:port>	syslog: the receiver's address.
--syslog-transport <t>	syslog: udp, tcp or tls (default tcp; tls verifies against the system roots).
--protocol <p>	otlp_http: the OTLP/HTTP encoding, protobuf (default) or json.
--auth-header <name>	otlp_http: the request header the token travels in (e.g. X-Scope-OrgID); empty sends it as Authorization: Bearer.
--ssl-verify	otlp_http: verify the receiver's TLS certificate (default true; --ssl-verify=false is an explicit opt-out for self-signed receivers).
--ssl-ca-cert <pem-or-path>	otlp_http: a CA trust anchor for the receiver — a PEM block inline or a certificate file path on the server host; empty uses the system roots.
--event-filter <prefixes>	Event-type prefixes to forward, comma-separated (e.g. warn:,api:security:; a trailing * is accepted). Empty forwards every event.
--display-name <name>	Human-readable connection name.
--enabled	Whether the connection forwards events (default true).
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

See also

• opschain docs cli/admin-siem-test — verify the receiver before relying on it.
• opschain docs cli/admin-siem-update — rotate the token or replace the filter.