Compliance Suite
The Enterprise edition can tail the committed audit log and push batches to an external SIEM — Splunk, Elasticsearch, QRadar, or anything that accepts HTTP JSON.
How it works
- Cursor-based tailing with at-least-once delivery (cursor persisted in
audit.db, so restarts never skip or duplicate beyond the guarantee) - Every batch is signed with HMAC-SHA256 (
X-Siem-Signatureheader) — your SIEM can verify authenticity - Secrets are AES-encrypted at rest
Wire formats
| Format | Description |
|---|---|
generic | Plain JSON batches |
splunk-hec | Splunk HTTP Event Collector |
elasticsearch-bulk | Elasticsearch _bulk API (default index bichon-audit) |
Features
- Category filters: forward only
login,delete,export,admin, orrepairevents if you don't want the full stream. Dual-control and GDPR erasure events ride theadmincategory, so they stay together with the approval trail. - Field mapping: an optional line-based DSL to rename fields for your SIEM schema
- Test & preview endpoints to validate configuration before going live
API
Requires an Enterprise license.
| Method | Path | Description |
|---|---|---|
GET/POST | /api/v1/siem | Read / update SIEM configuration |
POST | /api/v1/siem/test | Send a test event |
POST | /api/v1/siem/preview | Preview mapped output |
Configuration is also available in the WebUI under Settings → SIEM.