SIEM integration
What reaches your SIEM today, and what does not yet.
Clavitor records every credential action in a hash-chained audit trail, and you can export it. A live feed to your SIEM, with a pull endpoint, streaming and standard log formats, is not built, though parts of its design are decided. This page keeps the two apart, so you can judge the product as it ships today.
Today
A real audit trail, and a CSV you can load yourself.
Each vault keeps its own audit log. Every event carries a time, an action, an outcome (with a reason where there is one), the entry it touched, the actor, the source IP, and its position in the chain. You filter the log by entry, actor, IP, action, outcome and date range, then export the filtered view.
The fields
time · action · outcome · reason · entry · actor · ip · seq
The export
A CSV file of the view you filtered, downloaded from the audit page of your vault. It holds up to 500 events per export; narrow the filters to reach the rest.
Getting it into a SIEM
The file is plain CSV, so any SIEM that ingests files can take it. The loading is yours to arrange: there is no connector, agent or scheduled delivery from Clavitor today.
Integrity
Evidence, not just a log.
Every event is hashed into the one before it, and one call re-walks the chain and reports intact or broken, and where it broke. Each vault's chain position is also sent to central, by default every ten minutes, as an off-box witness; a log that gets shorter than its witnessed position, or changes a witnessed hash, raises an operator alert. How the chain and the witness work →
Not built yet
The SIEM feed.
None of the following exists in the product today. No endpoint for it answers, and no log format other than the CSV above can be produced.
Pull endpoint and streaming
A SIEM polling an endpoint for new events, or events pushed to it as they happen. Both have been described in our plan copy; neither exists. They are listed here as not built, not as a promise.
Standard log formats
Mapping of the audit feed to OCSF, CEF or LEEF for your SIEM. Decided as optional output of the log node; not built.
Log node and MSP audit view
A dedicated log node that receives audit events from the vaults over the encrypted Noise channel, keeps them as native Clavitor records (never as CEF or LEEF strings), and serves a multi-tenant audit viewer for an MSP's customers. Decided; not built. Audit event bodies are decided to stay off central.
The privacy rule
The rule any feed has to keep.
If the same person uses Clavitor for their own life and for their employer, the employer's SIEM must never see the personal side, not even a failed login on a personal account. This is a decided, hard rule for any feed: events are filtered by who owns the credential (personal or enterprise), not by who the user is, and tenants stay isolated from each other.
Today the rule holds because nothing is exported to any SIEM. There is no filter in the code yet, because there is no feed for it to guard. It becomes code with the feed, and it is a condition the feed has to meet.
Need a SIEM feed to buy?
Tell us the SIEM, the format and how you want the events delivered. We would rather design it with you than have you discover a limit later.