SIEM connection

Included from Basic tier

An instance-level connection object: one SIEM forwarder the event stream is pushed through (Splunk HEC, syslog/CEF, or OTLP/HTTP traces — a base capability, never behind a pack). The admin surface is SiemService (API v2, PostgreSQL-backed), gated on the /admin updatable determination; the CLI is opschain admin siem. Delivery is batched and at-least-once behind a durable per-connection cursor; forwarded payloads carry only the catalogued event row and the fixed envelope.

Data dictionary

Field	Meaning
id	The row id (UUID).
code	The estate code (1-64 of a-z0-9_-, immutable) the connection is addressed by, and the data.connection value on its warn:siem:delivery_failing events.
display_name	Human-readable name.
kind	The receiver kind, immutable: splunk_hec, syslog or otlp_http.
endpoint_url	splunk_hec: the HEC collector URL events POST to (http or https). otlp_http: the receiver's base URL — traces POST to <endpoint_url>/v1/traces (a URL that already ends in /v1/traces is used as given).
syslog_address	syslog: the receiver's host:port.
syslog_transport	syslog: udp, tcp (default) or tls (verified against the system roots).
protocol	otlp_http: the OTLP/HTTP encoding, protobuf (default) or json (the OTLP/JSON mapping). Refused by name on other kinds.
auth_header	otlp_http: the request header the token travels in (an HTTP header name, e.g. X-Scope-OrgID); empty sends it as Authorization: Bearer. Refused by name on other kinds.
ssl_verify	otlp_http: whether the receiver's TLS certificate is verified (default true; false is an explicit operator opt-out for self-signed receivers). Other kinds read true.
ssl_ca_cert	otlp_http: a CA trust anchor for the receiver — a PEM block inline, or a certificate file path on the server host; empty uses the system roots. Audit rows never carry the body.
event_filter	Event-type prefixes forwarded when set (e.g. warn:, api:security:; a trailing * is accepted and normalised away). Empty forwards every event.
secret	Write-only (create/update requests only; splunk_hec required, otlp_http optional, syslog refused; at least 8 characters when set): the receiver token — the HEC token, or the OTLP bearer/header token — encrypted at rest and never echoed by any read, audit row or error.
secret_set	Whether a receiver token is stored.
enabled	Whether the connection forwards events. Disabling pauses the delivery cursor in place; re-enabling resumes from the paused position.
health.last_delivered_at	When the receiver last acknowledged a batch.
health.consecutive_failures	The failure streak; a sustained streak lands a throttled warn:siem:delivery_failing event.
health.last_error	The latest delivery failure (empty while healthy). Never credential material.
health.lag_seconds	Seconds between the cursor and the newest event; absent while the cursor is unseeded or the stream is empty.
health.cursor_created_at	The created_at of the last event the cursor passed.
created_at / updated_at	Timestamps.

The delivery contract

The forwarder scans events past the cursor in (created_at, id) order (trailing real time by a short settle window), applies the prefix filter set-based, and delivers one batch per sweep: Splunk HEC JSON envelopes (sourcetype opschain:event, the event row as the event body), CEF records (CEF:0|LimePoint|OpsChain|<version>|<event type>|…, severity mapped from the type prefix — error 9, warn 6, audit 5, api 3, else 1), or OTLP/HTTP traces (one trace per correlation chain, one synthetic root span per chain per batch, one span per event with identifiers under opschain.* — the mapping is on opschain docs integrations-siem). The cursor advances only on acknowledgement (at-least-once — receivers dedup on the explicit event id, or on the span ids derived from it), a refused batch retries with backoff (an HTTP receiver's refusal is recorded by status, never by body), and the FOR UPDATE SKIP LOCKED claim on the delivery state is the cross-replica lease. TestSiemConnection sends one synthetic info:siem:test event through the same path without touching the stream or the cursor.