SIEM
Your log platform becomes a witness for the segment of the chain it holds.
Every event that leaves for your SIEM carries its sequence number and its row hash. That is what turns a copy into evidence. Your platform holds an independent record of what the chain said at the time, and a later edit on our side cannot agree with it.
What is in an event
- The sequence number, the row hash and the hash of the row before it.
- The call: agent, workspace, binding, class, method, host, path.
- The decision, who took it, and on which surface.
- The result: status, size, duration, and a reference to the body if one was kept.
What is never in an event
No credential value, no sealed content and no request body. The sealed payload stays sealed to a recipient the writer does not hold, and the export path is the one place it travels.
A sink that fails for fifteen minutes raises an alert on our side. A journal that quietly stopped shipping is the failure that matters here.