Version: v5.6.1

13.3 SIEM export

Included from Basic tier

After this you can: push the event feed to Splunk or a CEF-speaking receiver, verify delivery, filter and watch connection health.

Before you start — tick each one:

Lesson 5.1 — The record: events and chains (opschain learn 5.1)

In the GUI: the Operations area's Activity panel is the same stream the SIEM receives, and a sustained delivery failure lands there as warn:siem:delivery_failing; the connections are administered from the CLI.

"Can your evidence feed our SIEM?" — yes, as a base capability (no pack, no entitlement). The server pushes its event feed — every audited write, warning, approval and lifecycle event — to your SIEM with batched, at-least-once delivery behind a durable cursor, so your security team's alerting and retention see OpsChain without polling anything. This lesson registers one connection of each kind, proves delivery, narrows the filter and reads the health. The guide opschain docs getting-started/integrations-siem is the day-to-day reference; the component reference is opschain docs integrations-siem and every verb is on opschain docs cli/admin-siem.

You need admin rights on the OpsChain server and either a Splunk HEC token or a syslog receiver that accepts CEF.

1. Splunk, via HTTP Event Collector

Create an HEC token in Splunk (Settings → Data inputs → HTTP Event Collector), then register the connection — the token never rides the command line and no read ever returns it:

SPLUNK_HEC_TOKEN=... opschain admin siem create splunk-main \
  --kind splunk_hec \
  --endpoint-url https://splunk.example.com:8088/services/collector/event \
  --secret-env SPLUNK_HEC_TOKEN

Created SIEM connection splunk-main (splunk_hec -> https://splunk.example.com:8088/services/collector/event)

Events arrive with sourcetype=opschain:event; the event body is the catalogued event row (id, type, created_at, username, node_path, data) and nothing else. Dedup on event.id if your pipeline replays.

2. Anything CEF-speaking, via syslog

QRadar, ArcSight, Sentinel's syslog collector, rsyslog — point a syslog connection at it:

opschain admin siem create soc-syslog --kind syslog \
  --syslog-address siem.example.com:6514 --syslog-transport tls

Created SIEM connection soc-syslog (syslog -> tls://siem.example.com:6514)

3. Verify delivery

test pushes one synthetic info:siem:test event through the connection's real sender:

opschain admin siem test splunk-main

Delivered a synthetic test event through splunk-main

A receiver that is not listening says so at once, and nothing is lost in the meantime — the cursor holds until the receiver acknowledges:

opschain admin siem test soc-syslog

Test delivery through soc-syslog FAILED: dial tcp 10.0.0.9:6514: connect: connection refused

4. Filter

The filter is a prefix list — forward only the security-relevant families, or leave it empty for everything:

opschain admin siem update splunk-main --event-filter 'warn:,error:,audit:'

Updated SIEM connection splunk-main

--event-filter replaces the stored filter; a supplied token rotates the stored one.

5. Watch

list and show carry per-connection health: when the receiver last acknowledged, how far delivery lags the newest event, and the failure streak:

opschain admin siem list

CODE         KIND        TARGET                                                FILTER       ENABLED  LAG  FAILURES
splunk-main  splunk_hec  https://splunk.example.com:8088/services/collector/…  warn:,error: yes      2s   -
soc-syslog   syslog      tls://siem.example.com:6514                           all events   yes      1s   -

opschain admin siem show soc-syslog

Code:             soc-syslog
Id:               01a2fc00-…
Display name:     -
Kind:             syslog
Target:           tls://siem.example.com:6514
Event filter:     all events
HEC token:        -
Enabled:          yes
Last delivered:   2026-10-27T14:20:31Z
Lag:              1s
Failures:         -

A receiver outage loses nothing — batches retry with backoff and the cursor advances only when acknowledged — and a sustained streak lands a throttled warn:siem:delivery_failing event you can route to a watch or a mandate (lessons 5.5 and 11.4). Disabling a connection pauses its cursor in place for a later resume; deleting it removes the cursor.

Check yourself

What delivery guarantee does the export make, and what holds the place of the last acknowledged event? Then: which two columns of opschain admin siem list tell you a receiver has gone quiet?

What you learned

SIEM export is base: a Splunk HEC or CEF-over-syslog connection, token vaulted, registered in one command.
Delivery is batched and at-least-once behind a durable cursor; an outage loses nothing and a sustained failure is a loud event.
test proves the sender, --event-filter narrows the families, and list/show carry lag and failure streak per connection.

Next: this closes the module Integrations — back to your track (opschain learn).

1. Splunk, via HTTP Event Collector​

2. Anything CEF-speaking, via syslog​

3. Verify delivery​

4. Filter​

5. Watch​

Check yourself​

What you learned​