Skip to content

siem-integrations.md

Latest commit

 

History

History
143 lines (115 loc) · 3.45 KB

siem-integrations.md

File metadata and controls

143 lines (115 loc) · 3.45 KB
Raw

SIEM And Alert Integrations

Interlock can dispatch scan results to Slack, Datadog, Splunk HEC, Elastic, PagerDuty, Sumo Logic, or a generic webhook. Dispatch errors are logged and do not break the scan path.

Outbound events are content-redacted by default: they include prompt SHA-256 and UTF-8 byte length, but no raw prompt, arguments, or model-generated reason. Setting SIEM_INCLUDE_CONTENT=true adds bounded prompt and reason previews to all SIEM and webhook destinations. This is an explicit sensitive-data export; enable it only when every destination and retention policy is approved for the content handled by Interlock.

Supported Providers

Provider Config key Notes
Slack slack Sends a Slack-compatible webhook message.
Datadog datadog Sends logs to Datadog HTTP intake.
Splunk HEC splunk_hec Sends events to Splunk HTTP Event Collector.
Elastic elastic Sends documents to an Elastic index.
PagerDuty pagerduty Triggers incidents for high/critical results.
Sumo Logic sumologic Sends JSON to an HTTP source URL.
Webhook webhook Sends generic JSON to a configured endpoint.

Slack Example

{
  "siem_configs": [
    {
      "provider": "slack",
      "webhook_url": "https://hooks.slack.com/services/...",
      "min_severity": "HIGH"
    }
  ]
}

Datadog Example

{
  "siem_configs": [
    {
      "provider": "datadog",
      "api_key": "<YOUR_DATADOG_API_KEY>",
      "region": "us",
      "source": "interlock",
      "min_severity": "MEDIUM"
    }
  ]
}

Splunk HEC Example

{
  "siem_configs": [
    {
      "provider": "splunk_hec",
      "url": "https://splunk.example.com:8088",
      "token": "<YOUR_SPLUNK_HEC_TOKEN>",
      "verify_ssl": true,
      "min_severity": "LOW"
    }
  ]
}

Elastic Example

{
  "siem_configs": [
    {
      "provider": "elastic",
      "url": "https://elastic.example.com",
      "api_key": "<YOUR_ELASTIC_API_KEY>",
      "index": "interlock-logs",
      "verify_ssl": true
    }
  ]
}

Generic Webhook Example

{
  "siem_configs": [
    {
      "provider": "webhook",
      "url": "https://security.example.com/interlock-alerts",
      "headers": {"Authorization": "Bearer <YOUR_WEBHOOK_BEARER_TOKEN>"},
      "min_severity": "LOW"
    }
  ]
}

Test A Provider

Testing a SIEM destination can send configured credentials and sample event content, so /siem/test requires an API key with the admin scope.

Production outbound protection rejects private and on-prem IP destinations, including hostnames with any private answer. Direct private SIEM delivery is therefore not supported by the Phase 1 production profile. Use a globally routable authenticated collector endpoint, or a deployment-controlled relay at an enforced egress/firewall boundary. Ambient HTTP proxy variables are not a supported relay mechanism because guarded clients intentionally ignore them.

curl -X POST http://localhost:8001/siem/test \
  -H "x-api-key: <YOUR_INTERLOCK_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "slack",
    "config": {
      "webhook_url": "https://hooks.slack.com/services/..."
    }
  }'

Enterprise Note

For a pilot, start with Slack or generic webhook. For a production security team, route high and critical decisions to SIEM and incident response, then keep low/medium events in audit logs for investigation.