SIEM streaming

SafeHanded can stream its audit log to your SIEM as it happens, so handovers, reveals and purges sit beside the rest of your security monitoring. For: Owners and Admins on the Team plan or above.

Destinations

Destination	Use it for	Status
Splunk	Splunk Cloud or Splunk Enterprise via the HTTP Event Collector. Also CrowdStrike Falcon LogScale, Cribl and OpenObserve HEC inputs.	Verified
Microsoft Sentinel	Sentinel or any Log Analytics workspace, through the Logs Ingestion API.	Verified
Datadog	Datadog Logs, on any Datadog site (UK1, EU1, US…).	Verified
Elastic / OpenSearch	Elasticsearch, Elastic Cloud and Elastic Security, OpenSearch, the Wazuh indexer.	Verified
Generic HTTPS	Anything that takes JSON over HTTPS: Sumo Logic, Cribl, Logstash, Graylog or your own receiver.	Verified

On-premises SIEMs that can’t receive over the internet (QRadar, ArcSight, LogRhythm and similar) can pull events instead with the events API (GET /api/v1/events), or take the generic HTTPS stream through a collector of their own.

Connect one

Settings → Integrations → Connect, pick the destination, fill in the fields from its setup page, then open it again and press Send test event. The Team plan includes one destination; the MSP plan up to five.

Start from decides what is sent first:

• Everything in the audit log: your whole retained log, oldest first, then new events.
• New events only: from now on. This is the default for Datadog, which drops logs older than 18 hours.

A stream per client (MSPs)

On the MSP plan in MSP mode, a destination can send All events (everything, for every client, as above) or one client’s events: choose the client under Sends when you connect it. Use it when a client has its own SIEM, or a SOC watching it, and wants its own credential handovers there, while your own SIEM keeps everything.

• A client stream gets that client’s requests, shares and everything that happened to them. Organisation events (members, sign-in, keys, settings, billing, integrations) stay with you.
• Events name the technician who acted, with their IP address and browser, because that’s what the client’s auditor needs to see. Tell the client before you connect it.
• You can have up to 5 All-events streams, plus 2 per client. Several destinations can send the same scope.
• Each client event carries client_seq, that client’s own running count (Sentinel: ClientSeq). A client stream has gaps in seq, because other clients’ events aren’t in it, but client_seq has none, so the client can still spot a missing event. Each event’s hash and signature still check out on its own; checking the whole chain needs every event, so that stays with your All-events stream or an audit export.
• If your organisation leaves the MSP plan or MSP mode, client streams keep their place but stop sending, and show Not in use. They carry on from where they stopped if you come back.

What is sent

Every event is the same record you get in an audit export: the event name, level, actor, request/share/client ids, IP address, user agent, metadata and time, plus org_id and the hash-chain fields seq, prev_hash and hash, and the event’s signature (sig, by the key sig_key_id, published at /.well-known/safehanded-audit-key.json). No secret is ever in an event: no credential, link, code or key.

Format. Most destinations offer two:

• SafeHanded JSON (default): the record as it is. Keeps the hash chain, so you can verify from your SIEM that nothing was altered.
• OCSF 1.1 (beta): the Open Cybersecurity Schema Framework. Sign-ins are Authentication (3002), member and key changes are Account Change (3001), everything else is API Activity (6003). The full SafeHanded record is kept under unmapped.safehanded.

Delivery

• Events ship in order, within about a minute, in batches split to fit each destination’s limits.
• Delivery is at least once. After a failure an event may arrive twice: de-duplicate on org_id + seq. Elastic and OpenSearch do this for you (each event has a fixed document id).
• If the destination is down or refuses a batch, SafeHanded keeps its place, marks the destination Needs attention with the reason, records integration_failed once in the audit log, emails your Owners and Admins, and carries on from the same event when the destination recovers. Nothing is skipped. See when a connection stops working.
• A quiet organisation still finds out: Splunk, Elastic, OpenSearch, Datadog and Sentinel destinations are checked every hour without sending an event.
• Destinations must be reachable from the internet over HTTPS. Private and internal addresses are refused.