OpenTelemetry export (Enterprise)
An Enterprise fleet can forward its detection stream to the monitoring you already run: one OpenTelemetry (OTLP) event per evaluated change, streamed daemon to your own collector. It stays inside your network and never touches the PoisonZero cloud. This page lists what is exported, where it goes, and how it is configured.
What it is
An owner-scoped OpenTelemetry export that forwards every detection event to a collector or SIEM you run:
- Standard OTLP: no proprietary agent and no bespoke integration; any OpenTelemetry-compatible collector or backend works.
- Fixed attribute names under a
poisonzero.*namespace, plus mirroredsecurity_rule.*attributes, so dashboards and alerts stay stable as the model or fleet changes. - Enterprise feature, available in Cloud mode and Private mode alike.
- Fail-soft: if the collector is unreachable, export retries in the background; detection and enforcement are never blocked.
What is exported
One event (poisonzero.detection) is emitted per evaluated change. This is the complete attribute set, with the OTLP key, what it carries, and when it is populated:
| Attribute | Description | When populated |
|---|---|---|
poisonzero.verdict.label | The detection verdict label, benign or malicious | Always |
poisonzero.verdict.danger | The graded danger value in the range 0 to 1 | Always |
poisonzero.verdict.category | The attack category: direct-injection, exfiltration, meta-attack, role-play, subtle or benign | When a category is set |
poisonzero.verdict.danger_band | A coarse danger band for grouping without the raw score | When a band is set |
poisonzero.threat_level | Severity tier, low, medium or high; the field to alert on | Always |
poisonzero.evidence.present | Whether grounded evidence was found for the verdict (boolean) | Always |
poisonzero.evidence.grounded | Whether that evidence is grounded in the change (boolean) | When evidence is present |
poisonzero.evidence.hash | SHA-256 of the evidence excerpt | When evidence is present |
poisonzero.evidence.length | Length of the evidence excerpt | When evidence is present |
poisonzero.evidence.quote | The evidence excerpt itself, redacted or verbatim per detail level | Only at detail redacted or full, and only for a threat level high event |
poisonzero.chunk.index | Index of the evaluated window when the change was chunked | When the change was windowed |
poisonzero.chunk.count | Number of evaluated windows | When the change was windowed |
poisonzero.file.path_hash | SHA-256 of the file path; the path itself is never emitted at the default level | Always |
poisonzero.model.tier | The detection model tier | When the model tier is set |
poisonzero.model.version | The detection model version | When the model version is set |
poisonzero.model.sha256 | SHA-256 of the detection model artifact | When the model hash is set |
poisonzero.decision.action | What the daemon did: flag, detected_kept, quarantine_reversible or revert (allow is never exported) | Always |
poisonzero.decision.reason_code | Why, when applicable: malformed_output, degraded_score or ungrounded_evidence | When a reason applies |
file.path | The file path, redacted or verbatim per detail level, in the standard semantic-conventions field | Only at detail redacted or full, and only for a threat level high event |
security_rule.name | The model identity, mirrored into the OpenTelemetry security namespace for generic SIEMs | Always |
security_rule.version | The model version, mirrored into the security namespace | When the model version is set |
security_rule.category | The attack category, mirrored into the security namespace | When a category is set |
security_rule.uuid | The model artifact identifier, mirrored into the security namespace | When the model hash is set |
Where it goes
The stream runs daemon to your collector over OTLP/HTTP. Any OpenTelemetry-compatible collector or backend works, for example:
- Grafana
- Datadog
- Splunk
- Elastic
- Your own OpenTelemetry collector
Detail level
You decide locally, per export profile, how much each event carries. Hashes is the default:
| Level | What it adds |
|---|---|
hashes (default) | Hashes, enums and numbers only; no file path and no evidence excerpt. |
redacted | Adds a redacted file path and a redacted evidence excerpt. |
full | Adds the verbatim evidence excerpt: a deliberate local decision. |
full level is reachable only from a local profile, never through remote config, and Private mode always stays at hashes.Configuration
The export is configured per daemon through a named export profile, the same pattern as the BYO-inference profiles. Standard OpenTelemetry environment variables are respected:
| Variable | Effect |
|---|---|
OTEL_EXPORTER_OTLP_LOGS_ENDPOINT | Full OTLP logs endpoint, used as-is (no path is appended). |
OTEL_EXPORTER_OTLP_ENDPOINT | Base endpoint; the daemon appends the standard /v1/logs path. |
OTEL_EXPORTER_OTLP_HEADERS | Collector headers as key=value,key=value (also the _LOGS_HEADERS variant). |
For a fleet, the profile is managed centrally through a dedicated Admin API (/v1/otel-config, GET / PUT / DELETE). Collector authentication headers are held in the backend secret manager, never baked into the daemon image.
.local collector with enforced hashes, so a private deployment can still emit telemetry to a strictly on-device sink without opening a remote egress path.Read next
The daemon egress it does not use: network and firewall requirements. What the cloud-assisted flow sends for evaluation: what Cloud mode sends.
Detection events, right in the stack you already run.
Standard OpenTelemetry, fixed attribute names, and the stream never leaves your network. An Enterprise feature.
Sign me up