SIEM and auditor exports

Deliver security events to your SIEM, export evidence for auditors, and what a compliance pack does and does not prove.

SIEM delivery

Intertrace delivers security events through a durable queue as signed JSON envelopes. Set up a webhook in Settings → Integrations → Webhook (an HTTPS URL and a signing secret of at least 16 characters), then press Test. Destinations can also be Datadog Logs, Splunk HEC or PagerDuty. SIEM export is included on Scale and Enterprise.

{
  "schema": "intertrace.siem_event.v1",
  "id": "<uuid-or-source-id>",
  "org_id": "<org-uuid>",
  "event_type": "finding_created",
  "occurred_at": "2026-07-12T12:00:00.000Z",
  "payload": { }
}

event_type	When
gateway_event	A gateway event that created no finding
finding_created	A finding created from a gateway event
decision_recorded	A BLOCK, FLAG, DENY or REDACT decision
finding_status_changed	A finding's status changes
incident_created	A person opens an incident
incident_status_changed	An incident's status changes
hiro_action_proposed / hiro_investigation_completed	HIRO proposes an action or completes an investigation
test	The Test button

With a signing secret, webhooks carry X-Intertrace-Signature: sha256=<hmac-hex>. Verify it over the raw body:

import hmac, hashlib

def verify(body: bytes, secret: str, header: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)

Failed deliveries retry with exponential backoff, up to 8 attempts. Telemetry retention is separate from audit retention.

Auditor exports

Reports → compliance pack exports Markdown (human-readable pack), Controls CSV (control mapping appendix), DLP/runtime CSV (the chronological enforcement trail) or JSON. Pick whole UTC days with dateFrom / dateTo (YYYY-MM-DD); the dates filter the query itself. The runtime trail includes tool-call decisions with their reason and signal codes.

Estate → Export AI-BOM downloads the organization's inventory as CycloneDX 1.7 JSON. Hop-level JSON for one correlated run: GET /api/exports/agent-run/{runId}.

Evidence, not attestation

Findings map to a subset of OWASP LLM, NIST AI RMF, ISO 42001, SOC 2, GDPR, MITRE ATLAS and EU AI Act controls. Each pack includes a claim boundary, an integrity digest, runtime configuration, control mappings, an evidence manifest, the runtime decision trail and audit history.

A control is failing with open critical or high findings, needs review with open non-critical findings or no mapped evidence yet (never a vacuous pass), and passing only with mapped evidence or remediation and no open findings.