PoisonZero can stream every detection event — verdict, score, threat level, model version — as OpenTelemetry (OTLP) straight into your existing stack. Any OTel-compatible collector or backend: Grafana, Datadog, Splunk, Elastic, or your own. No special integration to build.
Detection events show up directly in the observability system you already run. Any collector or backend that speaks OTLP works — no bespoke PoisonZero integration to build or maintain.
Fixed attribute names under a poisonzero.* namespace, plus mirrored security_rule.* attributes for generic security dashboards. Build your own dashboards and alerts — like paging on threat level high — without reverse-engineering a payload format.
The OTLP stream runs daemon → your collector and never touches the PoisonZero cloud. It works with zero cloud connectivity — private and on-prem daemons included. You decide locally how much detail to include; none of it reaches us. This is the strongest part of the feature: full visibility, no privacy trade-off.
OpenTelemetry export is configured locally, per daemon, the same way you'd wire up any other OTel-instrumented service.
Add your OTLP endpoint to a named export profile in the daemon config — the same pattern as our BYO-inference profiles. Standard OTEL_EXPORTER_OTLP_* environment variables are respected.
Verdict, danger score, threat level, decision, and model version go out as one OTel event per evaluated change — nothing aggregated away.
If your collector is unreachable, export just retries in the background — detection and enforcement are never blocked or delayed by an observability hiccup.
# daemon config — named export profile otel: enabled: true endpoint: "https://otel-collector.internal:4318" detail: hashes # hashes | redacted | full [otel] exporting via OTLP/HTTP → otel-collector.internal [detect] verdict=flag threat_level=high danger=0.89 → event sent [otel] stream stays inside your network · nothing reaches PoisonZero cloud
Every detection event carries the same attribute names, event after event. Build a dashboard or alert once — it keeps working as the model or fleet changes underneath it. A selection of the attribute set:
| Attribute | What it carries |
|---|---|
| poisonzero.verdict.label | The detection verdict, e.g. benign, injection, meta-attack. |
| poisonzero.verdict.danger | Danger score, 0.00–0.99. |
| poisonzero.threat_level | Severity tier — the field to alert on, e.g. “page on threat level high.” |
| poisonzero.decision.action | What the daemon did: allow, flag, quarantine, or revert. |
| poisonzero.model.version | Which detection model produced the verdict. |
| security_rule.category | Mirrored into the OTel semantic-conventions security namespace, so generic security dashboards and SIEMs display something out of the box too. |
Full-detail observability and data privacy are usually a trade-off. With OpenTelemetry export they aren't — because the stream never leaves your network in the first place.
The OTLP stream goes daemon → your collector, full stop. In the OpenTelemetry context, no detection content ever reaches the PoisonZero cloud — regardless of which detail level you choose locally.
The export runs the same way whether the daemon is cloud-managed or fully private, on-prem, with zero cloud connectivity. Your observability stack, your rules.
Set locally per profile whether events carry hashes only, a redacted excerpt, or the full evidence — the same leak-discipline default used elsewhere in the product, under your control.
OpenTelemetry export is an Enterprise feature. Talk to us about turning it on for your fleet — and about which collector and detail level fit your environment.
Contact sales