opschain admin siem create

Included from Basic tier

Registers a SIEM forwarder connection. The code and --kind are immutable after create; everything else can change through the update verb. The delivery cursor seeds at the newest event, so history is never replayed against connections created later — forwarding begins with the next event.

For splunk_hec the HEC token is write-only: supply it through --secret-env (the name of an environment variable holding it) or --secret-prompt (a no-echo prompt), never on the command line; it is encrypted at rest and no read ever returns it.

SPLUNK_HEC_TOKEN=... opschain admin siem create splunk-main \
  --kind splunk_hec \
  --endpoint-url https://splunk.example.com:8088/services/collector/event \
  --secret-env SPLUNK_HEC_TOKEN --event-filter 'warn:,error:,audit:'
Created SIEM connection splunk-main (splunk_hec -> https://splunk.example.com:8088/services/collector/event)

opschain admin siem create soc-syslog --kind syslog \
  --syslog-address siem.example.com:6514 --syslog-transport tls
Created SIEM connection soc-syslog (syslog -> tls://siem.example.com:6514)

Flags

Flag	Meaning
--kind <kind>	Receiver kind: splunk_hec or syslog. Required, immutable.
--endpoint-url <url>	splunk_hec: the HEC collector URL (http or https).
--secret-env <name>	Name of an environment variable holding the Splunk HEC token (never pass the value itself on the command line).
--secret-prompt	Prompt for the HEC token without echo (reads a line from stdin when piped).
--syslog-address <host:port>	syslog: the receiver's address.
--syslog-transport <t>	syslog: udp, tcp or tls (default tcp; tls verifies against the system roots).
--event-filter <prefixes>	Event-type prefixes to forward, comma-separated (e.g. warn:,api:security:; a trailing * is accepted). Empty forwards every event.
--display-name <name>	Human-readable connection name.
--enabled	Whether the connection forwards events (default true).
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).

See also

• opschain docs cli/admin-siem-test — verify the receiver before relying on it.
• opschain docs cli/admin-siem-update — rotate the token or replace the filter.