Skip to Content
Welcome to the Novantra documentation.
GuidesGovernanceModulesSIEM Exports

SIEM Exports

SIEM Exports records the governed configuration and evidence for sending sanitized Novantra operational, audit, security, API, webhook, connector, and AI-adjacent events to a customer monitoring stack.

Use it when your security or operations team needs downstream monitoring evidence without turning Novantra into one SIEM vendor, one security tool, one tender scenario, or one country-specific product.

What SIEM Exports Owns

  • Export profiles and provider-neutral adapter keys.
  • Destination kind and safe destination snapshots.
  • Source selection for eligible event families.
  • Redaction, delivery, and integrity policy snapshots.
  • Export jobs, delivery attempts, retry or dead-letter posture, and health records.
  • Integrity snapshots with hashes and source-chain references where available.
  • Provider-neutral adapter descriptors and deployment-dependent delivery runtime posture.
  • Audit export fields, work-management descriptors, compliance-posture signals, Activity labels, and security-event descriptors for SIEM export health.

SIEM Exports stores metadata, status, capability state, sanitized snapshots, hashes, and evidence refs. It does not store raw source text, prompts, provider payloads, vectors, embeddings, storage keys, object paths, bearer tokens, webhook signing secrets, connector credentials, or database-shaped internals.

User Journey

  1. Open Developers > SIEM Exports.
  2. Review available adapter descriptors and event sources with their capability states.
  3. Create a profile with a provider-neutral adapter key and destination kind.
  4. Add safe destination, credential-reference, redaction, delivery, and integrity snapshots.
  5. Select the event sources that the profile is allowed to export.
  6. Test the profile to record destination health evidence.
  7. Activate the profile with a governed reason.
  8. Review jobs, delivery attempts, dead-letter posture, integrity snapshots, and health records.

Delivery Runtime

The SIEM delivery runtime processes queued and retryable SIEM export jobs through the shared async job registry. A scheduled runner and a repair/replay job use the same SIEM-owned command path.

The runtime creates:

  • a hash-chain integrity snapshot for the selected source descriptors;
  • a delivery attempt with delivered, retry-scheduled, or dead-letter posture;
  • a health record with configured, provider-not-configured, deployment-dependent, or evidence-required capability state;
  • source-selection and profile delivery timestamps when delivery succeeds.

Deployment-specific delivery behavior is resolved through a configured runtime adapter. If no adapter is configured, jobs record provider-not-configured health and retry or dead-letter according to the profile delivery policy. Novantra does not imply that a vendor SIEM accepted the batch unless the deployment adapter records that result.

The launch adapter path is Generic HTTPS JSON. It sends sanitized JSON batches to a configured HTTPS collector, such as a self-hosted log collector or a customer-operated monitoring endpoint. Destination failures, blocked destinations, and unavailable adapters are recorded as delivery posture rather than hidden success.

Adapter Descriptors

V1 adapter descriptors are provider-neutral:

  • Generic HTTPS JSON (launch delivery path).
  • Generic syslog.
  • Generic event hub or stream.
  • S3-compatible drop.
  • File drop.

These descriptors describe destination class, credential-reference behavior, payload hash and chain evidence, and runtime-adapter posture. They do not bake Splunk, Sentinel, LogRhythm, SAS, or any other vendor schema into core product ownership.

The profile and evidence records are Novantra-owned. The external SIEM remains customer-owned, including final alerting, correlation, incident assignment, and retention in that external platform.

Source Coverage

V1 source descriptors cover product-safe metadata for:

  • audit events;
  • security events;
  • public API and webhook activity;
  • enterprise connector events.

Additional AI runtime, source-owner, install, support-access, identity, or provider events must come from their owning modules through safe descriptors before they can be exported. When a source is not available, Novantra should show roadmap, reference-only, not-configured, provider-not-configured, policy-blocked, deployment-dependent, no-AI profile, or another accurate capability state.

Redaction And Integrity

Each selected source carries a redaction behavior such as metadata-only, redact-restricted, hashed-identifiers, or blocked.

Delivery and integrity records should carry hashes, counts, status, sanitized failure summaries, and evidence snapshots. They must not carry raw event payloads, source text, prompts, provider responses, vectors, storage locations, or secrets.

When the workspace audit ledger has signed checkpoints or completed anchor evidence, SIEM integrity snapshots can reference the current checkpoint and anchor state. SIEM Exports does not create or modify that ledger evidence; it records sanitized references so the exported delivery stream can be correlated with the audit evidence available at the time.

Cloud And On-Prem

Cloud and on-prem deployments expose the same SIEM Exports product behavior. Deployment-specific destination configuration, provider availability, customer-held credentials, ledger signing, anchor providers, and network reachability appear as capability states, health records, or integrity evidence, not as different product semantics.

Where It Is Managed

SIEM Exports is managed from the Developers > SIEM Exports workspace surface, where operators create profiles, select sources, test destinations, and review delivery and integrity evidence. Machine-to-machine access to Novantra’s curated, versioned API surface is documented under External Integrations through stable /api/v1 contracts.

Last updated on
Security OperationsCryptography