SIEM and audit export

SIEM export streams Definite audit records to your security and retention systems. It is decision evidence for monitoring and audit, separate from operational telemetry.

Supported destinations

Field	Type	Required	Description
splunk_hec	Streaming	Token	Sends each audit record to a Splunk HTTP Event Collector endpoint.
datadog_logs	Streaming	API key	Sends audit records to the Datadog Logs intake API.
elastic_bulk	Streaming	Authorization header	Writes audit records through the Elasticsearch bulk API.
s3_jsonl	Archive	AWS access	Writes gzipped JSONL objects with per-object manifests to an S3 bucket.

Records

Two record types ship, versioned by schema field:

definite.audit.decision.v2 — one per recorded ledger decision: identifiers, actor and tool context, decision status and confidence bucket, reason, event and leaf hashes, receipt signature metadata, and checkpoint linkage when sealed.
definite.audit.checkpoint.v2 — one per sealed Merkle checkpoint: root hash, previous checkpoint hash, signer key ID, signature, tree size, signing time, and export status.

Raw tool arguments are excluded by default; records carry a tool.args_hash (sha256: digest) instead. An administrator can opt a destination into raw argument export explicitly (include_raw_tool_args).

Endpoints

Field	Type	Required	Description
GET/siem-exports	Config	No	List configured destinations with delivery stats, last success, and last error.
POST/siem-exports	Config	No	Create a destination. Secrets are write-only and stored in the tenant secret store.
PUT/siem-exports/{destinationID}	Config	No	Update configuration or enabled state.
DELETE/siem-exports/{destinationID}	Config	No	Delete a destination.
POST/siem-exports/{destinationID}/test	Delivery	No	Send a synthetic test record.
POST/siem-exports/{destinationID}/replay	Delivery	No	Re-deliver records over a selected time window.

Admins can also manage destinations in the console under Settings → Audit Exports.

Delivery behavior

Ledger writes never wait on SIEM delivery. Committed records queue per destination and a background worker delivers them, retrying with backoff (30 seconds up to 24 hours) before marking a delivery dead. Outbound requests go through an SSRF-guarded HTTP client; provider secrets are never returned by the API.

For S3, objects are written under:

ledger-events/yyyy/mm/dd/hh/*.jsonl.gz
ledger-checkpoints/yyyy/mm/dd/hh/*.jsonl.gz

Each object has a companion .manifest.json recording what was written and its hash.