Observability

Stream every event to your SIEM, signed and verifiable.

Audit and security events push in real time to Splunk, Datadog, Elastic, Microsoft Sentinel, S3 WORM, plain syslog, or a generic HTTPS webhook (Enterprise plan). Each event carries the audit row's Ed25519 signature and the id of the key that made it; your company's public key is published at /audit/pubkey/:company_id. Failed deliveries retry with backoff for up to a day, then park in a dead-letter queue you can replay.

Caldyr

Splunk

Datadog

Elastic

Sentinel

S3 WORM

Syslog

How it works

Event emitted

An audit row is signed and broadcast to the SIEM pusher.

Signature block attached

The envelope is the audit row plus its signature block: sig, key_id, pubkey_fp, prev_hash, payload_hash. One signing key per company, not per destination.

Pushed to your sink

Six auth modes per destination - none, bearer, mTLS, signed JWT, Sentinel OAuth2 and Sentinel shared key - and a destination that names no mode gets none. mTLS and signed JWT send no shared secret; bearer sends the sink's own token on every push, Sentinel OAuth2 an Azure AD access token, Sentinel shared key an HMAC keyed by your workspace key, and Splunk or Datadog still send their token under mTLS. HTTP sinks must be https:// and TCP syslog must be TLS, but syslog over UDP is unencrypted.

Replay on reconnect

Failed deliveries retry with backoff for up to 24 hours, then park in a dead-letter queue you can replay.

Deep dives

Signed envelopes

The block is an Ed25519 signature over the audit row as stored, chained to the previous row: sig, key_id, pubkey_fp, prev_hash, payload_hash. raw_json, ECS, OCSF and syslog carry all five; CEF and LEEF carry the signature and key id only. Your company's public key is published at /audit/pubkey/:company_id, and we ship no verifier for your side - checking the block is your SIEM's job. On a destination with filter transforms, the signature covers the row as it was before the transform.

Delivery guarantees

At-least-once with idempotent IDs. Failed batches retry with backoff; after the last retry, or on a permanent rejection, they park in a dead-letter queue you replay by hand.

WORM / compliance sinks

S3 Object Lock in governance or compliance mode for immutable storage: auditors get retention proof out of the box.

Configure a sink

shell · curl

# 1. store each credential, get back a handle (company admin) $ curl -X POST $CALDYR_URL/api/siem/secret-bindings \ -H "Authorization: Bearer $CALDYR_TOKEN" -H "Content-Type: application/json" \ -d '{"team_id": "<your-team-uuid>", "field": "mtls_cert_ref", "value": '"$(jq -Rs . < client.pem)"'}' # → 201 {"handle": "<32 hex>", "ref": "vault-ref://h/<32 hex>", …} # value is a PEM file, JSON-escaped by jq; repeat with field mtls_key_ref (key PEM) and mtls_bearer_ref (Splunk HEC token) # 2. create the destination, referencing the returned refs $ curl -X POST $CALDYR_URL/api/siem/destinations \ -H "Authorization: Bearer $CALDYR_TOKEN" -H "Content-Type: application/json" \ -d '{"name": "splunk-prod", "kind": "splunk_hec", "url": "https://splunk.example.com:8088", "format": "ecs", "batch_size": 100, "auth_kind": "mtls", "config": { "mtls_cert_ref": "vault-ref://h/<cert handle>", "mtls_key_ref": "vault-ref://h/<key handle>", "mtls_bearer_ref": "vault-ref://h/<token handle>"}}'

Your SIEM is the source of truth - we just feed it, signed.

When the breach inquiry comes in, the auditor uses your signed records, not ours. We're the courier.

Compare

	Caldyr	Webhooks (unsigned)	Manual log export
Real-time delivery	push · none, bearer, mTLS, JWT or Sentinel	unsigned POST	batch only
Signed envelopes	Ed25519 block · company key	no	no
Replay on reconnect	durable buffer	drop on failure	N/A
Multiple sinks	all simultaneously	one URL	manual
WORM compliance	S3 Object Lock	no	no

FAQ

What if my SIEM is offline?

Failed deliveries are retried with backoff and then parked in a dead-letter queue you can replay. The control plane keeps running.

Can I send to multiple sinks at once?

Yes. A common setup is Splunk for SOC + S3 WORM for compliance + Datadog for engineering, all from the same event stream with independent filter rules.

What event format?

raw_json by default; ECS, CEF, LEEF, syslog, and OCSF variants are available per sink, plus custom field mappings via a YAML transform.

Can I redact sensitive fields?

Per-sink filter rules support jsonpath → redact. PII fields can be stripped before they reach lower-trust sinks.

Ready to govern your AI infrastructure?

Request access in minutes, or talk to us about your air-gap deployment.

Get started