Skip to main content
Version: v5.6.1

SIEM export — feeding Splunk and syslog/CEF receivers

Included from Basic tier

"Can your evidence feed our SIEM?" — yes, as a base capability (no pack, no entitlement). The server pushes its event feed — every audited write, warning, approval and lifecycle event — to your SIEM with batched, at-least-once delivery behind a durable cursor, so your security team's alerting and retention see OpsChain without polling anything. The full reference is opschain docs integrations-siem.

1. Splunk, via HTTP Event Collector​

Create an HEC token in Splunk (Settings → Data inputs → HTTP Event Collector), then register the connection — the token never rides the command line and no read ever returns it:

SPLUNK_HEC_TOKEN=... opschain admin siem create splunk-main \
  --kind splunk_hec \
  --endpoint-url https://splunk.example.com:8088/services/collector/event \
  --secret-env SPLUNK_HEC_TOKEN
Created SIEM connection splunk-main (splunk_hec -> https://splunk.example.com:8088/services/collector/event)

Events arrive with sourcetype=opschain:event; the event body is the catalogued event row (id, type, created_at, username, node_path, data) and nothing else. Dedup on event.id if your pipeline replays.

2. Anything CEF-speaking, via syslog​

QRadar, ArcSight, Sentinel's syslog collector, rsyslog — point a syslog connection at it:

opschain admin siem create soc-syslog --kind syslog \
  --syslog-address siem.example.com:6514 --syslog-transport tls

Records are CEF:0|LimePoint|OpsChain|<version>|<event type>|… with severity mapped from the event-type prefix (error 9, warn 6, audit 5, api 3) and the event id as externalId.

3. Verify, filter, watch​

opschain admin siem test splunk-main          # one synthetic info:siem:test event
opschain admin siem list                      # kind, target, filter, lag, failures
opschain admin siem update splunk-main --event-filter 'warn:,error:,audit:'

The filter is a prefix list — forward only the security-relevant families, or leave it empty for everything. list/show carry per-connection health: when the receiver last acknowledged, how far delivery lags the newest event, and the failure streak. A receiver outage loses nothing — batches retry with backoff and the cursor holds until acknowledged — and a sustained streak lands a throttled warn:siem:delivery_failing event you can route to notifications (opschain docs cli/admin-siem for every verb).