Skip to main content

​
Stream audit logs to your SIEM

This page covers SIEM sinks — configured connectors that stream your workspace’s audit trail to the observability platform your security team already runs: Splunk (HTTP Event Collector), Datadog Logs, a tenant-owned Amazon S3 bucket, or a generic HTTPS log drain. If your SOC policy says every audit event must land in your own SIEM, this is the control to configure before your first compliance review.
This page describes Devotel Orbit’s platform controls. It is not legal advice. Your audit and retention obligations depend on your industry, your regulators, and your contracts. Confirm the specifics with qualified counsel.

​
Why a SIEM sink and not just the webhook

Orbit already publishes every audit event as an HMAC-signed audit.log.created webhook (see Audit log). That gives you a push channel — but the payload is Orbit’s generic JSON envelope. If you point it at Splunk HTTP Event Collector or the Datadog Logs intake, your team must stand up its own receiver, reshape the payload into each vendor’s native ingest contract, and POST it on. SIEM sinks close that gap. You register the delivery target once per sink type, and Orbit delivers each audit event in the vendor’s native format directly to: Each sink can carry an optional event-category filter (the same mini-language as the audit.log.created webhook stream — e.g. security or authentication,deletion; omit it to stream every category), so a Splunk sink can receive only security-relevant events while a parallel S3 sink keeps the full trail.
SIEM sinks stream your workspace’s audit trail to a destination you own. They perform no outbound messaging and change nothing about how audit records are created.

​
Endpoints

All routes live under /api/v1/compliance. Reads require any authenticated API key; writes require an owner or admin key — audit egress to a third-party system is a security control. Every mutating call is itself recorded in your audit log. The GET response has three parts:
  • sinks — one entry per configured type with its endpoint, category filter, label, lifecycle state, and timestamps (created, updated, activated, paused, last successful delivery).
  • types — the supported-type catalog: label, description, an endpoint example, the endpoint format hint, whether the type requires a credential reference, and the vendor’s documentation URL.
  • posture — the resolved posture: configured_count, active_count, active_types, and streaming (true when at least one sink is actively delivering). The dashboard reads this to show whether your audit trail is flowing to your SIEM.

​
Lifecycle: pending → active → paused

A sink is a connector with an explicit state, not a checkbox: Two transitions are deliberately strict: A changed endpoint must be re-activated. Updating an existing sink with a new endpoint resets it to pending, so you cannot silently redirect a live audit feed to a new destination without confirming the target. Updates that keep the same endpoint (changing the filter or label) preserve the current state. Activation is gated on readiness. POST .../activate checks that the endpoint is well-formed for the sink type and — for types that authenticate (splunk_hec, datadog, s3) — that a credential reference is recorded. A hard config failure is rejected with 409 SIEM_SINK_NOT_READY, so a sink that cannot deliver is never brought live. Other activation conflicts: 404 SIEM_SINK_NOT_FOUND when no sink of that type exists, 409 SIEM_SINK_ALREADY_ACTIVE when it is already delivering. Pause similarly rejects a non-active sink with 409 SIEM_SINK_NOT_ACTIVE.

​
Credentials are never echoed

A sink stores a credential reference — a secret-manager alias such as siem/splunk/acme-hec-token — never the credential material itself. To keep even that alias from leaking to a lower-privileged viewer, no read response ever returns it: GET /siem-sinks reports only has_credential: true | false per sink. Provision the actual token or role in your secret manager and record its alias on the sink.

​
Examples

Replace dv_live_sk_... with an owner or admin API key for the write calls.

​
Read the current configuration and posture

​
Splunk (HTTP Event Collector)

The endpoint must be a well-formed HTTPS URL; a malformed one is rejected with 409 SIEM_SINK_INVALID_ENDPOINT.

​
Datadog Logs

​
Amazon S3

The only sink type whose endpoint is an S3 URI rather than an HTTPS URL:

​
HTTPS log drain

A generic drain has no credential requirement — record a reference if your receiver authenticates, omit it otherwise:

​
Pause or remove a sink

​
Tenant-owned posture

SIEM sinks are a tenant-owned control. Orbit delivers your audit events to the destination you configure, in the vendor format for the sink type — the destination itself (the Splunk index, the Datadog organization, the S3 bucket and its retention policy, the drain receiver) is yours to provision, secure, and monitor. Orbit does not retain a copy of the stream beyond its own audit ledger, and it does not validate your SIEM-side obligations. Verify the posture from your side: after activation, confirm events are arriving at the destination, and watch last_delivery_at (reported per sink in GET /siem-sinks) as your liveness signal. Pauses and deletions take effect immediately.