Enterprise · Observability

Detection events, right in the observability stack you already run.

The poison0 agent can stream every detection event (verdict, score, threat level, model version) as OpenTelemetry (OTLP) straight into your existing stack. Any OTel-compatible collector or backend: Grafana, Datadog, Splunk, Elastic, or your own. No special integration to build.

Enterprise featureAny OTel-compatible backendStays inside your networkNo content reaches our cloud
How it works

How OpenTelemetry export works

  1. Any OTel backend.

    Events stream via OTLP/HTTP to Grafana, Datadog, Splunk, Elastic or your own collector - no bespoke integration.

    OpenTelemetry export

  2. One event per change.

    Verdict, danger score, threat level, decision and model version, nothing aggregated away.

  3. Stays in your network.

    The stream runs from the daemon to your collector, never through the PoisonZero cloud, and works on private and on-prem daemons.

  4. You set the detail.

    Per export profile: hashes only, redacted excerpt or full evidence.

  5. Never blocks detection.

    If your collector is unreachable, the events are dropped; detection and enforcement are never blocked or delayed.

# daemon config - named export profile
otel:
  enabled: true
  endpoint: "https://otel-collector.internal:4318"
  detail: hashes   # hashes | redacted | full

[otel]   exporting via OTLP/HTTP → otel-collector.internal
[detect] verdict=flag threat_level=high danger=0.89 → event sent
[otel]   stream stays inside your network · nothing reaches PoisonZero cloud
Standardized attributes

Fixed field names, so your dashboards don't break.

Every detection event carries the same attribute names, event after event. Build a dashboard or alert once - it keeps working as the model or fleet changes underneath it. A selection of the attribute set:

AttributeWhat it carries
poisonzero.verdict.label The detection verdict, e.g. benign, injection, meta-attack.
poisonzero.verdict.danger Danger score, 0.00-0.99.
poisonzero.threat_level Severity tier - the field to alert on, e.g. “page on threat level high.”
poisonzero.decision.action What the daemon did: allow, flag, quarantine, or revert. Middle-band cases that aren't clearly safe are asked on the device (keep or reject, within a time window); the log records the outcome - kept, rolled back, or timed out (which counts as a rejection).
poisonzero.model.version Which detection model produced the verdict.
security_rule.category Mirrored into the OTel semantic-conventions security namespace, so generic security dashboards and SIEMs display something out of the box too.
This is a preview of the attribute set, not the full reference - the complete field list and evidence-detail options (hashes / redacted / full) are covered during Enterprise onboarding. Ask us for the full attribute reference →

Read the docs

Bring detection events into your stack.

OpenTelemetry export is an Enterprise feature. Talk to us about turning it on for your fleet - and about which collector and detail level fit your environment.

Contact sales