SIEM/audit export

Included from Basic tier

The push half of the audit lane, shipped as a base capability — never behind a pack: the server streams its event feed to a customer SIEM so security teams wire OpsChain's governance evidence into their existing alerting and retention. The pull half — evidence-ledger segment export — is a separate surface (opschain docs governance).

The pieces

• SIEM connections (opschain admin siem, v2 SiemService): the admin-managed forwarder records. Two kinds:
  • splunk_hec — Splunk HTTP Event Collector. Events POST to the collector URL as concatenated JSON envelopes authenticated by a write-only HEC token (encrypted at rest; reads serve secret_set only, and no response, audit row or error ever echoes it).
  • syslog — CEF over syslog, UDP/TCP/TLS (TLS verifies against the system roots), to any CEF-speaking receiver (QRadar, ArcSight, Sentinel collectors, rsyslog…).
• The forwarding engine: one durable cursor over the events table per connection. Every server replica sweeps; a FOR UPDATE SKIP LOCKED claim on the connection's delivery state is the cross-cluster lease, so N replicas never double-send. Batches deliver at-least-once in (created_at, id) order and the cursor advances (compare-and-swap) only after the receiver acknowledged; the scan trails real time by a short settle window so late-committing rows are never skipped.
• The event-type filter: an optional prefix list per connection (warn:, api:security:, …; a trailing * is accepted). Empty forwards every event.

Payloads

Forwarded payloads carry only the catalogued event row and a fixed envelope — events are secret-free by the standing redaction rule, and the forwarder adds nothing beyond them. Receivers dedup on the explicit event id.

Splunk HEC (one JSON document per event, concatenated per batch):

{"time": 1793615400.000, "host": "<server host>", "source": "opschain",
 "sourcetype": "opschain:event",
 "event": {"id": "<event uuid>", "type": "warn:steps:slow",
           "created_at": "2026-11-02T10:30:00Z", "username": "…",
           "node_path": "/projects/demo", "data": { …the event's data… }}}

CEF (one record per event; over TCP/TLS newline-framed, one datagram each over UDP, each behind a <PRI> + RFC3339 timestamp + host syslog header):

CEF:0|LimePoint|OpsChain|<version>|<event type>|<event type>|<severity>|
  externalId=<event uuid> rt=<epoch ms> suser=<username>
  cs1Label=nodePath cs1=<node path> msg=<the event's data JSON>

Severity maps from the event-type prefix: error 9, warn 6, audit 5, api 3, everything else 1 (syslog priority follows: err/warning/info on facility local0).

Delivery health and failure

Every admin read carries the connection's health: last_delivered_at, lag_seconds (how far the cursor trails the newest event), consecutive_failures and last_error. A refused batch retries with backoff (30s → 2m → 8m → 30m) and never advances the cursor, so nothing is lost while a receiver is down; a sustained failure streak lands a throttled warn:siem:delivery_failing event (one per connection per window) that notifications and triggers can act on. opschain admin siem test probes a receiver with one synthetic info:siem:test event through the real formatter and sender.

Access and audit

Every verb sits behind the admin-plane authorization determination; writes and tests are audited as api:siem_connections:create|update|destroy|test — never carrying the HEC token. Deleting a connection removes its cursor; disabling pauses the cursor in place for a later resume.