SIEM connection

Included from Basic tier

An instance-level connection object: one SIEM forwarder the event stream is pushed through (Splunk HEC or syslog/CEF — a base capability, never behind a pack). The admin surface is SiemService (API v2, PostgreSQL-backed), gated on the /admin updatable determination; the CLI is opschain admin siem. Delivery is batched and at-least-once behind a durable per-connection cursor; forwarded payloads carry only the catalogued event row and the fixed envelope.

Data dictionary

Field	Meaning
id	The row id (UUID).
code	The estate code (1-64 of a-z0-9_-, immutable) the connection is addressed by, and the data.connection value on its warn:siem:delivery_failing events.
display_name	Human-readable name.
kind	The receiver kind, immutable: splunk_hec or syslog.
endpoint_url	splunk_hec: the HEC collector URL events POST to (http or https).
syslog_address	syslog: the receiver's host:port.
syslog_transport	syslog: udp, tcp (default) or tls (verified against the system roots).
event_filter	Event-type prefixes forwarded when set (e.g. warn:, api:security:; a trailing * is accepted and normalised away). Empty forwards every event.
secret	Write-only (create/update requests only; splunk_hec only, at least 8 characters): the HEC token, encrypted at rest and never echoed by any read, audit row or error.
secret_set	Whether a HEC token is stored.
enabled	Whether the connection forwards events. Disabling pauses the delivery cursor in place; re-enabling resumes from the paused position.
health.last_delivered_at	When the receiver last acknowledged a batch.
health.consecutive_failures	The failure streak; a sustained streak lands a throttled warn:siem:delivery_failing event.
health.last_error	The latest delivery failure (empty while healthy). Never credential material.
health.lag_seconds	Seconds between the cursor and the newest event; absent while the cursor is unseeded or the stream is empty.
health.cursor_created_at	The created_at of the last event the cursor passed.
created_at / updated_at	Timestamps.

The delivery contract

The forwarder scans events past the cursor in (created_at, id) order (trailing real time by a short settle window), applies the prefix filter set-based, and delivers one batch per sweep: Splunk HEC JSON envelopes (sourcetype opschain:event, the event row as the event body) or CEF records (CEF:0|LimePoint|OpsChain|<version>|<event type>|…, severity mapped from the type prefix — error 9, warn 6, audit 5, api 3, else 1). The cursor advances only on acknowledgement (at-least-once — receivers dedup on the explicit event id), a refused batch retries with backoff, and the FOR UPDATE SKIP LOCKED claim on the delivery state is the cross-replica lease. TestSiemConnection sends one synthetic info:siem:test event through the same path without touching the stream or the cursor.