SIEM & Telemetry

Antemure forwards incidents and high-risk events off the endpoint as CEF over syslog or an HTTP collector, with a durable retry outbox so nothing is lost, and can archive raw telemetry to S3-compatible storage for long-term retention.

Format & sinks

Export is CEF (ArcSight Common Event Format), delivered to one or both sinks:

• Syslog — RFC-5424 framed CEF over UDP or TCP to host:port.
• HTTP collector — CEF posted to an HTTP endpoint with a bearer token. This is how Antemure feeds Splunk HEC, Microsoft Sentinel, and any generic HTTP collector.

CEF severity (0–10) is derived from the event's risk score. There is a single CEF serializer — Splunk/Sentinel/QRadar/Elastic are all reached through these two CEF sinks rather than product-specific formats.

Configuration

Configure under the siem section or by environment (setting a syslog address or HEC URL auto-enables export):

siem:
  enabled: true
  syslog_addr: "siem.internal:514"     # AURA_SIEM_SYSLOG
  syslog_protocol: "tcp"               # AURA_SIEM_PROTOCOL  (udp|tcp)
  hec_url: "https://splunk:8088/services/collector"   # AURA_SIEM_HEC_URL
  hec_token: "<hec-token>"              # AURA_SIEM_HEC_TOKEN (masked on read)
  cef_vendor: "SecureInsights"
  cef_product: "Antemure"
  forward_events: true                 # forward high-risk raw events, not just incidents
  forward_min_risk: 0.7

The whole siem block is fleet-pushable from the hub (Settings → Data); an empty hec_token on a push preserves the existing one. Tokens are masked in any config-returning API.

Delivery & durability

Incidents are forwarded fire-and-forget the moment they open. When forward_events is on, each high-risk raw event (≥ forward_min_risk) is written to a durable siem_outbox table, one row per sink keyed for idempotency; a background worker drains it every 15 s with exponential backoff (up to ~30 min), retrying up to 8 times before marking a row terminal (reaped after 7 days). SIEM delivery never blocks detection.

S3 long-term archive

Independently of SIEM, Antemure can archive events (NDJSON) to S3-compatible storage before they are pruned locally — AWS S3, MinIO, Cloudflare R2, Wasabi. Configure under archive (bucket, region, prefix, endpoint, credentials, path_style, archive_after_days; see Configuration). The endpoint console exposes a connectivity test and a rehydrate action to pull archived events back for a time range.

What the hub “integrations” mean