What ships in each event

One JSON event per receipt. Same envelope whether it hits Splunk, Datadog, or a webhook.

{
  "receipt_sha":      "sha256:…",
  "prev_receipt_sha": "sha256:…",
  "sequence_number":  4821,
  "ts":               "2026-07-12T09:41:22.104Z",
  "tenant":           "acme-prod",
  "principal":        { "sub": "agent:invoice-bot", "device": "…" },
  "action":           "transact",
  "resource":         { "type": "payment", "id": "…" },
  "decision":         "allow",
  "obligations":      ["pii.mask.email", "budget.debit:2.40"],
  "policy_version":   "sha256:…",
  "metering":         { "tokens_in": 812, "tokens_out": 214, "usd": 0.019 }
}

Splunk HEC

HTTPS POST, one event per receipt, HEC token auth.

# ~/.aarmos/sinks/splunk.yaml
kind: splunk_hec
url:   https://splunk.acme.internal:8088/services/collector
token: env:SPLUNK_HEC_TOKEN
index: aarmos
sourcetype: aarmos:receipt

Illustrative configuration. Destinations are managed in the workspace settings for editions that include them; there is no supported command-line sink setup.

Datadog Logs

/api/v2/logs with DD-API-KEY. Tagged for filtering and dashboards.

# ~/.aarmos/sinks/datadog.yaml
kind: datadog_logs
site:   datadoghq.com          # or datadoghq.eu, us3, us5, ap1
api_key: env:DD_API_KEY
ddsource: aarmos
service:  aarmos-runtime
tags: ["env:prod", "team:security"]

Anything else

Generic webhook (HMAC-signed) and syslog sinks cover Sumo, Elastic, Chronicle, S3 → Athena, and homegrown lakes.

kind: webhook
url:  https://siem.acme.internal/ingest/aarmos
hmac_secret: env:AARMOS_SINK_HMAC   # X-Aarmos-Signature: sha256=…
batch: { max_events: 100, max_wait_ms: 500 }

DIY on Evaluation

Team includes one evidence destination. Enterprise unlocks unlimited destinations with routing (Kafka, EventBridge, OpenTelemetry) and conditional filtering. On Evaluation there is no built-in forwarding. The reference CLI (not publicly distributed) can follow the local ledger and emit chain-check results as JSON lines; that output is not the receipt envelope shown above, and forwarding it is your own integration.

aarmos verify --tail --json \
  | vector --config /etc/vector/aarmos.toml

Detections worth wiring first

• Denied high-risk action: action:(transact OR delete OR control) decision:deny → page on-call.
• Sequence gap or hash mismatch: missing sequence_number or prev_receipt_sha that doesn't match the prior event → integrity alert.
• Metering anomaly: per-agent spike in metering.tokens_out or metering.usd vs 7-day baseline.
• Canary tripwire fired: obligations:*canary* → SOC investigate.