SIEM export: Splunk & Datadog

Every receipt is signed and hash-chained. Your SIEM doesn't just store the log — it can verify tampering and detect sequence gaps.

Preview the wire format →See the exact bytes shipped to each sink, format-validated in your browser.

What ships in each event

One JSON event per receipt. Same envelope whether it hits Splunk, Datadog, or a webhook.

{
  "receipt_sha":      "sha256:…",
  "prev_receipt_sha": "sha256:…",
  "sequence_number":  4821,
  "ts":               "2026-07-12T09:41:22.104Z",
  "tenant":           "acme-prod",
  "principal":        { "sub": "agent:invoice-bot", "device": "…" },
  "action":           "transact",
  "resource":         { "type": "payment", "id": "…" },
  "decision":         "allow",
  "obligations":      ["pii.mask.email", "budget.debit:2.40"],
  "policy_version":   "sha256:…",
  "metering":         { "tokens_in": 812, "tokens_out": 214, "usd": 0.019 }
}

Splunk HEC

HTTPS POST, one event per receipt, HEC token auth.

# ~/.aarmos/sinks/splunk.yaml
kind: splunk_hec
url:   https://splunk.acme.internal:8088/services/collector
token: env:SPLUNK_HEC_TOKEN
index: aarmos
sourcetype: aarmos:receipt
aarmos sinks add ~/.aarmos/sinks/splunk.yaml
aarmos sinks test splunk_hec   # sends a canary receipt

Datadog Logs

/api/v2/logs with DD-API-KEY. Tagged for filtering and dashboards.

# ~/.aarmos/sinks/datadog.yaml
kind: datadog_logs
site:   datadoghq.com          # or datadoghq.eu, us3, us5, ap1
api_key: env:DD_API_KEY
ddsource: aarmos
service:  aarmos-runtime
tags: ["env:prod", "team:security"]

Anything else

Generic webhook (HMAC-signed) and syslog sinks cover Sumo, Elastic, Chronicle, S3 → Athena, and homegrown lakes.

kind: webhook
url:  https://siem.acme.internal/ingest/aarmos
hmac_secret: env:AARMOS_SINK_HMAC   # X-Aarmos-Signature: sha256=…
batch: { max_events: 100, max_wait_ms: 500 }

DIY on Evaluation

Team includes one evidence destination. Enterprise unlocks unlimited destinations with routing (Kafka, EventBridge, OpenTelemetry) and conditional filtering. On Evaluation, tail the local ledger as NDJSON and pipe it into your existing collector (Splunk UF, Datadog Agent, Vector, Fluent Bit).

avar verify --tail --format ndjson \
  | vector --config /etc/vector/aarmos.toml

Detections worth wiring first

  • Denied high-risk action: action:(transact OR delete OR control) decision:deny → page on-call.
  • Sequence gap or hash mismatch: missing sequence_number or prev_receipt_sha that doesn't match the prior event → integrity alert.
  • Metering anomaly: per-agent spike in metering.tokens_out or metering.usd vs 7-day baseline.
  • Canary tripwire fired: obligations:*canary* → SOC investigate.

Sinks run in the local runtime — receipts don't leave your device to reach Aarmos. See the receipt spec for the envelope and pricing for tier gates.