SIEM Integration

Pavri emits structured governance events that can be forwarded to any SIEM (Security Information and Event Management) platform. This guide covers the event schema and common integration patterns.

Phase 2 Note

Full SIEM forwarding pipeline (push to webhook, Splunk HEC, Datadog, Elastic) is planned for Phase 3. This guide covers the event schema and available pull-based integrations available now.

Available Event Types

All events are structured JSON with a common envelope:

{
  "event_type": "...",
  "org_id": "...",
  "agent_id": "...",
  "session_id": "...",
  "timestamp": "2026-03-20T10:00:00Z",
  "payload": { ... }
}

Governance Events

Event Type	Description
rollout.transition	A policy moved between rollout stages.
rollout.frozen	A rollout freeze kill switch was activated.
rollout.unfrozen	Rollout freeze was lifted.
enforcement.disabled	All policies reverted to observe mode via kill switch.
replay.job_completed	A replay job finished with pass/fail calibration result.
replay.verdict	Individual replay verdict (match, diverged, error, timeout).

Attestation Events

Event Type	Description
attestation.issued	A new attestation claim was issued for an agent.
attestation.verified	An attestation claim was verified (pass or fail).
attestation.revoked	An attestation claim was administratively revoked.

Execution Routing Events

Event Type	Description
execution.routing_decision	Agent execution was routed to a specific sandbox mode.
egress.decision	An egress rule was evaluated for an outbound call.

Agent Governance Events

Event Type	Description
agent.peer_call_allowed	An agent-to-agent call was permitted by trust policy.
agent.peer_call_denied	An agent-to-agent call was blocked by trust policy.

Pull-Based Integration (Available Now)

All governance events are accessible via the Pavri REST API. Your SIEM or log shipper can poll these endpoints:

# Rollout transitions
GET /api/v1/governance/rollout?since=2026-03-20T00:00:00Z

# Execution routing decisions
GET /api/v1/governance/execution?since=2026-03-20T00:00:00Z

# Attestation events
GET /api/v1/governance/attestation?agentId=agt-1

Paginate results using the cursor parameter returned in responses.

Prometheus Metrics (Available Now)

Pavri exposes Prometheus metrics for all governance operations. Scrape the /metrics endpoint on the policy service:

pavri_rollout_transitions_total{org_id, policy_id, stage}
pavri_replay_jobs_total{org_id, verdict}
pavri_attestation_issued_total{org_id}
pavri_attestation_verifications_total{org_id, result}
pavri_execution_routing_decisions_total{org_id, mode, outcome}
pavri_kill_switch_operations_total{org_id, operation}

Use these metrics to build Grafana dashboards or alert on anomalous governance events.

Push Integration (Phase 3)

Phase 3 will add:

• Webhook delivery — POST governance events to a configurable HTTPS endpoint
• Splunk HEC — native Splunk HTTP Event Collector integration
• Datadog Logs — structured log forwarding via Datadog Agent
• Elastic/OpenSearch — index documents via Bulk API
• AWS Security Hub — publish findings to AWS Security Hub ASFF format

Event filtering, batching, and retry logic will be configurable per destination.

Event Schema Reference

rollout.transition

{
  "event_type": "rollout.transition",
  "org_id": "org-acme",
  "timestamp": "2026-03-20T10:00:00Z",
  "payload": {
    "policy_id": "pol-001",
    "from_stage": "observe",
    "to_stage": "soft_enforce",
    "transitioned_by": "alice@acme.com",
    "replay_job_id": "job-abc123",
    "calibration_pass": true
  }
}

attestation.verified

{
  "event_type": "attestation.verified",
  "org_id": "org-acme",
  "agent_id": "agt-payroll-001",
  "timestamp": "2026-03-20T10:01:00Z",
  "payload": {
    "claim_id": "atst-abc123",
    "status": "valid",
    "signing_algorithm": "hmac-sha256",
    "verified_by": "gateway-service"
  }
}

execution.routing_decision

{
  "event_type": "execution.routing_decision",
  "org_id": "org-acme",
  "agent_id": "agt-pci-agent",
  "session_id": "sess-xyz789",
  "timestamp": "2026-03-20T10:02:00Z",
  "payload": {
    "decision_id": "exec-001",
    "routing_mode": "container",
    "outcome": "denied",
    "reason": "container routing required but unavailable; fail-closed policy enforced.",
    "profile_name": "pci-scope-profile"
  }
}