Skip to main content

Integrate CodeGraph security events with SIEM

Configure Syslog, CEF, or LEEF handlers; verify dispatch, buffering, degradation, and downstream receipt. See the examples and checks before applying it.

Enterprise

CodeGraph can format and dispatch security events to configured Syslog, CEF, and LEEF handlers. The integration separates event creation, local dispatch, buffered retry, handler delivery, and downstream receipt. Preserve evidence for the stage required by the customer’s acceptance policy.

Contract and sources

The current implementation boundary is:

  • src/security/siem/base_handler.py — SecurityEventType, event fields, and handler interface;
  • src/security/siem/dispatcher.py — handler registration, dispatch attempts, status, and activity;
  • src/security/siem/buffer.py — bounded retry buffer;
  • src/security/siem/syslog_handler.py, cef_handler.py, leef_handler.py — output formats;
  • src/security/config.py and config.yaml under security.siem — typed settings.

Authenticated configuration, stats, and recent-event routes are available under the live /api/v1/security/siem surface. Use deployed OpenAPI for schemas.

Event contract

SecurityEvent includes the event type, timestamp, request ID, message, severity, and optional user, session, network, provider, model, DLP, token, latency, project, group, and detail fields. The current SecurityEventType enum is the source of truth; do not copy its count into policy.

Current families cover LLM request/response/error, DLP actions, Vault access/rotation, authentication success/failure, rate limiting, generic security alerts, path or IDOR violations, webhook replay, and MCP authentication failure. New releases can add types without changing the transport setup.

Configure handlers

Enable only the formats used by the receiving SOC:

Configure handlers
Handler Configuration boundary Typical transport
Syslog host, port, protocol, facility, app name UDP, TCP, or TLS according to policy.
CEF host, port, device vendor/product/version Receiver-compatible socket transport.
LEEF host and port Receiver-compatible socket transport.

Use DNS names and certificates managed by the customer. Prefer authenticated, encrypted transport across trust boundaries. Restrict egress to the receiver and never place passwords or private keys in committed configuration.

The dispatcher can initialize several handlers. Check delivery status for each configured handler.

Dispatch and buffering

Without a buffer, synchronous dispatch reports whether at least one handler sent the event. With a buffer, dispatch can report that the event was enqueued before a downstream send occurs. A full or exhausted buffer is a degraded security-control state.

Record:

  • enabled and successfully initialized handlers;
  • per-handler healthy or degraded status and last error summary;
  • recent dispatch attempts and their sent or failed state;
  • queue size, dropped or retried events, flush result, and retry exhaustion;
  • receiver-side event identity and ingestion time.

Do not call an enqueue acknowledgement “delivered.”

Validate end to end

Use a synthetic event that contains no repository secrets:

  1. record the release, effective SIEM config, and receiver index or channel;
  2. emit one event type expected by the configured handler;
  3. verify the local event and request ID;
  4. verify per-handler dispatch activity and buffer state;
  5. find the same identity in the downstream SIEM;
  6. record latency, normalization, severity, and field mapping;
  7. repeat a controlled negative test for unreachable receiver or invalid TLS.

For UDP, receiver-side receipt is mandatory when delivery matters. For TCP or TLS, verify indexing on the receiver after a successful write.

Monitor and alert

Alert on disabled required handlers, degraded status, buffer growth, repeated retries, dropped events, stale last-success time, and receiver ingestion gaps. Tie thresholds to the customer’s SLO and measured event rate.

Review whether sensitive fields should be redacted before transport. The SIEM is another data recipient and must be included in classification, retention, access, and deletion policies.

Failure and recovery

When delivery fails:

  1. preserve the first failure and effective configuration without secrets;
  2. distinguish formatting, DNS, network, TLS, receiver, and rate-limit failures;
  3. protect the buffer from unbounded growth or silent overwrite;
  4. restore the handler or apply an approved alternate channel;
  5. flush and reconcile pending events;
  6. verify downstream receipt and close the gap window explicitly.

Do not silently disable SIEM to restore application availability. If degraded operation is allowed, record the approver, duration, compensating monitoring, backlog plan, and exit condition.

Acceptance evidence

An enterprise evidence packet should include config digest, handler inventory, synthetic positive and negative tests, local dispatch activity, buffer statistics, downstream receipt, alert routing, retention ownership, known gaps, and recovery results. Review event coverage for every security-relevant product action as a separate control.

Report a documentation issue