SIEM export (Enterprise)

What it is

A local, file-based mirror of the daemon's audit trail:

• Every audit action is mirrored: allow, revert, quarantine, quarantine_reversible, detected_kept, meta_attack and fail_closed.
• Three formats, each an independently enabled rotating file: JSON lines, CEF (ArcSight Common Event Format) and syslog (RFC 5424).
• Local and air-gap safe: the daemon writes files to disk; the only optional network path is a syslog target you configure on your own network. Nothing is sent to the PoisonZero cloud.
• Best-effort and fail-open: every init and write error is swallowed; the export can never delay or block enforcement.

Enabling it

The export is configured by one local file, siem.json, in the daemon's config directory. It is deliberately not cloud-managed: no remote config can switch it on or redirect it. Edit the file, then restart the daemon:

{
  "enabled": true,
  "dir": "/var/log/poisonzero-siem",
  "formats": ["json", "cef", "syslog"],
  "syslog_target": "siem.example.com:514",
  "syslog_network": "udp",
  "group": "splunk"
}

Output files, rotation and permissions

• Rotation: each file rotates to *.1 at 10 MiB, so the mirror is size-bounded on disk.
• Default permissions: the directory is created 0755, the files are written 0600. The lines carry file paths and reasons, so by default only the daemon's own user may read them. On start the daemon also resets inherited group permissions back to these defaults.
• Forwarder access via group (Linux/macOS): a forwarder running as its own unprivileged user (splunk, nxlog, td-agent) gets read access through the optional group field: the directory becomes 0750, the files 0640, both owned by that group - including every fresh file created by rotation, which a plain file ACL would not survive. Add the forwarder user to that group.
• Fail-safe: if the group does not exist or setting group or mode fails, the export does not start (logged once). Files are never left with wrong permissions.
• Revoking: remove the field and the next daemon start resets directory and files back to 0755/0600; already rotated *.1 files are corrected at their next rotation.
• Windows: the field is ignored - POSIX modes do not apply there. Grant the forwarder account read access via the inherited directory ACL.

The JSON line

Each line is one audit entry; empty optional fields are omitted:

{"ts":"2026-06-10T12:00:00Z","action":"revert","path":"/home/dev/.claude/CLAUDE.md","reason":"prompt injection: exfiltration instruction","danger":0.93,"app_id":"app-7c1","agent":"claude-code","category":"exfil","threat_level":"high","evidence_sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","evidence_length":72}

The CEF line

Header: CEF:0|PoisonZero|PoisonZero|<daemon-version>|<action>|<action>|<severity>|<extensions>. Reserved characters are CEF-escaped in both header and extension values. The extensions map:

Severity (CEF 0 to 10) is driven by the threat level first: high is 9, medium is 6, low is 2. Only an entry without a threat level falls back to its action: quarantine 10; revert, meta_attack, fail_closed 9; quarantine_reversible, detected_kept 6; allow 2; an unknown action ranks by danger. In live data the level decides: a proven quarantine is high (9), a detected_kept is medium (6), so the two are already separated.

CEF:0|PoisonZero|PoisonZero|0.7.8|revert|revert|9|rt=2026-06-10T12:00:00Z act=revert fname=/home/dev/.claude/CLAUDE.md msg=prompt injection app=app-7c1 suser=claude-code cs2=high cs2Label=ThreatLevel cn1=0.93 cn1Label=Danger

The syslog line

RFC 5424, facility local0 (16), so PRI = 16 × 8 + severity. The message body is the CEF line above: CEF over syslog, the common SIEM convention. Severity mirrors the CEF logic, threat level first:

<132>1 2026-06-10T12:00:00Z build-host poisonzero - audit - CEF:0|PoisonZero|PoisonZero|0.7.8|revert|revert|9|rt=2026-06-10T12:00:00Z act=revert ...

Modes and air gap

The export behaves identically in Cloud mode and Private mode: it is a purely local sink, so a Private device loses nothing (see cloud or private). The feature makes no outbound connections of its own; the only network path is the syslog_target you explicitly configure, on your own network. In a fully air-gapped deployment, leave syslog_target unset and have your on-premises collector tail the files.

SIEM export or OpenTelemetry export?

Both are Enterprise features and both stay inside your network; they answer different questions:

Read next

What the audit trail itself records: incidents and audit. How long local data is kept: storage, retention and cleanup. The mode choice behind it all: cloud or private.