siem

One line of CEF (ArcSight's Common Event Format), like: "CEF:0|TB|detect|3.0.0|brute_force|Brute force|8|src=... suser=... cnt=..."

event is an alert from detect.run() or any map.

Event fields

• "vendor", "product", "version", "id" override the header.
• "severity" overrides the header's severity (0-10).
• "level" sets the severity (critical = 10).
• Other fields become extensions with standard CEF keys: ip -> src, user -> suser, message -> msg, and so on.

Options

• keys a map {your_field: cef_key} for your own key names.

One line of LEEF 2.0 (IBM QRadar's format), tab-separated attributes: "LEEF:2.0|TB|detect|3.0.0|brute_force|sev=8<tab>src=...". Same event shape as cef(). options: {"delimiter": "^", "keys": {...}}.

A syslog line, RFC 5424 by default, like

"<PRI>1 2026-03-12T08:02:11.000Z host app - - [tb@32473 level=\"high\" src=\"...\"] Brute force"

An alert map's fields go into the structured data.

Options

• format "rfc3164" for the classic "<PRI>Mar 12 08:02:11 host app: message".
• facility like "local0" (default: user).
• severity like "warning", or 0-7 (default: from the alert's level).
• host, app, time, msgid values for those parts of the line.

Send one syslog line (or a list of lines) to a syslog server over "udp" (default) or "tcp" (one line per message, newline-framed). Gives back {"sent": lines, "bytes"}. Only send to servers you run.

The flat event that cef(), leef() and the senders build from an alert. Handy to see what will be sent, or to tweak it before sending.

Fields

• "name", "level", "id", "time" from the alert.
• "severity" 0-10.
• The alert's by field, under its own name.
• count, description and tags.
• ip, user, host and message from the first record.

A Splunk HTTP Event Collector client. The token is never printed.

Methods

• send(events) posts each map as an event. Alerts from detect.run() are flattened with siem.event().

Options

• index, source, host set on every event.
• sourcetype the source type (default: "tb:detect").
• dry_run true to get the payload back instead of sending.
• timeout seconds to wait.
• verify false skips the TLS certificate check. Only for a test server with a self-signed certificate: anyone on the network could then read the token.

Returns (from send)

• "sent", "status", "ok", "response".
• In dry-run: "dry_run": true, "url", "headers" (token hidden), "body", "count".

Example

let s = siem.splunk("https://splunk.example:8088", "my-token", {"dry_run": true})
let out = s.send([{"user": "Tanisha", "action": "login"}])
say(out.body)

An Elasticsearch / OpenSearch client for the bulk API.

auth can be:

• nil no login.
• {"user", "password"} basic auth.
• {"api_key": "..."} an API key.
• text a bearer token.

Methods

• index(name, docs) indexes each map into the index name. Alerts from detect.run() are flattened and get @timestamp.

Options

• dry_run true to get the payload back instead of sending.
• timeout seconds to wait.
• verify false skips the TLS certificate check. Only for a test server with a self-signed certificate: anyone on the network could then read the token.

Returns (from index)

• "sent", "status", "response".
• "errors" how many documents failed.

Example

let auth = {"user": "tb", "password": "secret"}
let es = siem.elastic("https://es.example:9200", auth, {"dry_run": true})
let out = es.index("alerts-tb", [{"user": "Tanisha"}])
say(out.body)

A Microsoft Sentinel / Log Analytics client. It uses the HTTP Data Collector API with the shared-key signature.

key is the workspace's primary or secondary key (base64).

Methods

• send(log_type, records) posts records to a custom table. send("TBAlerts", records) creates the table TBAlerts_CL.

Options

• dry_run true to get the payload back instead of sending.
• timeout seconds to wait.
• verify false skips the TLS certificate check. Only for a test server with a self-signed certificate: anyone on the network could then read the token.
• url another endpoint (for tests and sovereign clouds).
• time_field the record field holding the event time.

Returns (from send)

• "sent", "status", "ok".

Example

let s = siem.sentinel("my-workspace-id", "c2VjcmV0", {"dry_run": true})
let out = s.send("TBAlerts", [{"user": "Tanisha"}])
say(out.url)

An IBM QRadar client.

Methods

• send(events) posts events as LEEF lines to url, a log source using QRadar's HTTP Receiver protocol.
• reference_set(name, values) adds values (IPs, hashes...) to a reference set with the REST API (POST /api/reference_data/sets/bulk_load/name).

reference_set() authenticates with an authorized service token read only from the environment variable QRADAR_SEC_TOKEN; it is never printed.

Options

• console the console address for the REST API (default: url without its port).
• version the REST API version header (default: "20.0").
• dry_run true to get the payload back instead of sending.
• timeout seconds to wait.
• verify false skips the TLS certificate check. Only for a test server with a self-signed certificate: anyone on the network could then read the token.

Example

let q = siem.qradar("https://qradar.example:12469", {"dry_run": true})
let out = q.reference_set("TB Bad IPs", ["203.0.113.42"])
say(out.url)

A Google Security Operations (Chronicle) client for an HTTPS webhook feed.

url is the feed's endpoint, ending in :importPushLogs.

The API key and the feed's secret key come only from the environment variables CHRONICLE_API_KEY and CHRONICLE_SECRET. They travel in headers, never in the URL, and are never printed.

Methods

• send(events) posts the events as newline-delimited JSON. Alerts from detect.run() are flattened with siem.event().

Options

• dry_run true to get the payload back instead of sending.
• timeout seconds to wait.
• verify false skips the TLS certificate check. Only for a test server with a self-signed certificate: anyone on the network could then read the token.

Example

let feed = "https://us-chronicle.googleapis.com/v1alpha/projects/p"
feed += "/locations/us/instances/i/feeds/f:importPushLogs"
let c = siem.chronicle(feed, {"dry_run": true})
say(c.send([{"user": "Tanisha", "action": "login"}]).body)