opschain admin siem

Included from Basic tier

Manage SIEM forwarder connections: the push half of the audit lane, streaming the event feed to a customer SIEM as a base capability (no entitlement gate). Each connection names a receiver and forwards every event — or an event-type prefix subset — with batched, at-least-once delivery behind a durable cursor:

• splunk_hec — Splunk HTTP Event Collector: JSON envelopes (sourcetype opschain:event, the catalogued event row as the event body) POSTed to the collector URL, authenticated by a write-only HEC token (encrypted at rest, never echoed by any read).
• syslog — CEF records (CEF:0|LimePoint|OpsChain|<version>|<event type>|...) over UDP, TCP or TLS (TLS verifies against the system roots), severity mapped from the event-type prefix (error 9, warn 6, audit 5, api 3, else 1).

Delivery is at-least-once: a batch that the receiver refuses is retried with backoff and the cursor never advances past an unacknowledged event, so receivers dedup on the envelope's explicit event id (event.id / externalId). Delivery health — last delivered, lag behind the newest event, consecutive failures — rides on every read, and a sustained failure streak lands a throttled warn:siem:delivery_failing event.

Forwarded payloads carry only the catalogued event row and the fixed envelope — events are secret-free by the standing redaction rule, and the forwarder adds nothing beyond them.

Every verb sits behind the admin-plane authorization determination, and every write is audited (api:siem_connections:create|update|destroy|test).

Verbs

• opschain docs cli/admin-siem-list — the connection table with health.
• opschain docs cli/admin-siem-show — one connection in full.
• opschain docs cli/admin-siem-create — register a connection.
• opschain docs cli/admin-siem-update — change fields, rotate the token or replace the filter.
• opschain docs cli/admin-siem-delete — remove a connection.
• opschain docs cli/admin-siem-test — send one synthetic test event.