SIEM & Log Forwarding

BitDrip emits security events in both CEF (ArcSight / Splunk) and LEEF (IBM QRadar) format, and supports forwarding proxy-daemon logs to any HTTP endpoint.

Policy Engine SIEM Output

Security events are written to the audit log and forwarded to your SIEM via the org integration settings. Configure via the Admin Dashboard under Settings → Integrations or via the API:

curl -X PATCH https://your-policy-engine/api/v1/organizations/<orgId>/settings \
  -H "Authorization: Bearer <admin-jwt>" \
  -H "Content-Type: application/json" \
  -d '{
    "integration": {
      "siemEndpoint": "https://your-siem.corp/collector",
      "siemToken": "<bearer-token>",
      "siemFormat": "cef"
    }
  }'

Supported siemFormat values: cef, leef.

CEF Event Format

CEF:0|BitDrip|PolicyEngine|2.1.0|POLICY_VIOLATION|SSN detected|7|
  src=10.0.1.42 suser=alice@corp.com act=BLOCK
  cs1=SSN_DETECTOR cs1Label=ruleId
  cs2=0.95 cs2Label=confidence
  correlationId=abc-123 msg=Content blocked by BitDrip privacy policy

LEEF Event Format

LEEF:2.0|BitDrip|PolicyEngine|2.1.0|POLICY_VIOLATION|^
  src=10.0.1.42^suser=alice@corp.com^action=BLOCK^
  ruleId=SSN_DETECTOR^confidence=0.95^correlationId=abc-123

Correlation IDs

Every evaluation request generates a correlationId that flows from the proxy-daemon through the policy engine and into the SIEM event. Use it to correlate proxy logs with policy engine audit records.

Proxy Daemon Log Forwarding

The proxy-daemon can forward its structured logs to any HTTP endpoint:

# Set in the workstation environment or .bitdrip/config.json
BITDRIP_LOG_FORWARD_URL=https://logs.corp.com/intake

Logs are buffered in memory and flushed every 30 seconds as a POST with Content-Type: application/json:

[
  { "level": "info", "message": "Request evaluated", "hostname": "api.openai.com", "action": "allow", "correlationId": "abc-123", "timestamp": "2026-06-02T19:00:00.000Z" },
  { "level": "warn", "message": "Request blocked", "hostname": "api.anthropic.com", "action": "block", "violations": 2, "correlationId": "def-456", "timestamp": "2026-06-02T19:00:15.000Z" }
]

The flush uses AbortSignal.timeout(5000) — if the endpoint is unreachable, the batch is dropped and the daemon continues without blocking traffic.

Splunk HEC Integration

Point siemEndpoint at your Splunk HTTP Event Collector:

siemEndpoint: https://splunk.corp.com:8088/services/collector/event
siemToken: Splunk <your-HEC-token>
siemFormat: cef

Alert Rules & Webhook Notifications

For threshold-based alerting (e.g., "notify when 10 violations occur within 60 minutes"), use Alert Rules — see Alert Rules & Webhooks.