Every receipt is signed and hash-chained. Your SIEM doesn't just store the log — it can verify tampering and detect sequence gaps.
What ships in each event
One JSON event per receipt. Same envelope whether it hits Splunk, Datadog, or a webhook.
{
"receipt_sha": "sha256:…",
"prev_receipt_sha": "sha256:…",
"sequence_number": 4821,
"ts": "2026-07-12T09:41:22.104Z",
"tenant": "acme-prod",
"principal": { "sub": "agent:invoice-bot", "device": "…" },
"action": "transact",
"resource": { "type": "payment", "id": "…" },
"decision": "allow",
"obligations": ["pii.mask.email", "budget.debit:2.40"],
"policy_version": "sha256:…",
"metering": { "tokens_in": 812, "tokens_out": 214, "usd": 0.019 }
}Splunk HEC
HTTPS POST, one event per receipt, HEC token auth.
# ~/.aarmos/sinks/splunk.yaml
kind: splunk_hec
url: https://splunk.acme.internal:8088/services/collector
token: env:SPLUNK_HEC_TOKEN
index: aarmos
sourcetype: aarmos:receiptaarmos sinks add ~/.aarmos/sinks/splunk.yaml
aarmos sinks test splunk_hec # sends a canary receiptDatadog Logs
/api/v2/logs with DD-API-KEY. Tagged for filtering and dashboards.
# ~/.aarmos/sinks/datadog.yaml
kind: datadog_logs
site: datadoghq.com # or datadoghq.eu, us3, us5, ap1
api_key: env:DD_API_KEY
ddsource: aarmos
service: aarmos-runtime
tags: ["env:prod", "team:security"]Anything else
Generic webhook (HMAC-signed) and syslog sinks cover Sumo, Elastic, Chronicle, S3 → Athena, and homegrown lakes.
kind: webhook
url: https://siem.acme.internal/ingest/aarmos
hmac_secret: env:AARMOS_SINK_HMAC # X-Aarmos-Signature: sha256=…
batch: { max_events: 100, max_wait_ms: 500 }DIY on Evaluation
Team includes one evidence destination. Enterprise unlocks unlimited destinations with routing (Kafka, EventBridge, OpenTelemetry) and conditional filtering. On Evaluation, tail the local ledger as NDJSON and pipe it into your existing collector (Splunk UF, Datadog Agent, Vector, Fluent Bit).
avar verify --tail --format ndjson \
| vector --config /etc/vector/aarmos.tomlDetections worth wiring first
- Denied high-risk action:
action:(transact OR delete OR control) decision:deny→ page on-call. - Sequence gap or hash mismatch: missing
sequence_numberorprev_receipt_shathat doesn't match the prior event → integrity alert. - Metering anomaly: per-agent spike in
metering.tokens_outormetering.usdvs 7-day baseline. - Canary tripwire fired:
obligations:*canary*→ SOC investigate.
Sinks run in the local runtime — receipts don't leave your device to reach Aarmos. See the receipt spec for the envelope and pricing for tier gates.