Push audit events to a SIEM

Before you start

• A sync server you run, with a licence that includes audit push.
• An https:// endpoint that accepts POSTs, such as a SIEM’s HTTP event collector.

1. Point the server at the endpoint

Set these on the server (all variables) and restart it:

STERNWAY_AUDIT_PUSH_URL=https://siem.example.com/collector
STERNWAY_AUDIT_PUSH_TOKEN=<token>   # only if the endpoint needs one

Without the licence nothing is sent and the server log says why. The events stay in the database and in the export.

2. Check what arrives

About a minute after each event, the server:

• POSTs batches of up to 500 events as application/x-ndjson. Each line is exactly an NDJSON export line, with Authorization: Bearer <token> when a token is set.
• Starts after the newest event the first time it sees the endpoint. Use the export for older ones.
• Moves on only after a 2xx answer. Otherwise it resends the same batch after 10 seconds, then 20, 40 and so on, up to every 15 minutes, for as long as it fails.
• Delivers at least once, not exactly once, so deduplicate by id.