SIEM/SOAR Integration

Pavri can forward alerts to your existing SIEM or SOAR platform in addition to delivering them through the standard alert channels (webhook, Slack, email). SIEM forwarding is best-effort and fail-open — a SIEM outage never blocks alert delivery through primary channels.

Supported Platforms

Platform	Protocol	Setup
Splunk	HTTP Event Collector (HEC)	Configure an HEC token and a trusted TLS endpoint.
Elasticsearch	Bulk API (NDJSON)	Configure authenticated access to a trusted TLS endpoint.
Azure Sentinel	Log Analytics Data Collector API	Configure a workspace ID and primary key.
IBM QRadar	Syslog RFC5424 + CEF	Configure the tenant-approved syslog listener.

---

Configuration

SIEM targets are configured via environment variables. Multiple targets can be enabled simultaneously.

Splunk HTTP Event Collector

SIEM_SPLUNK_ENDPOINT=https://your-splunk-host:8088
SIEM_SPLUNK_TOKEN=your-hec-token
SIEM_SPLUNK_INDEX=pavri_alerts        # optional, default: pavri_alerts

Elasticsearch

SIEM_ELASTIC_ENDPOINT=https://your-elastic-host:9200
SIEM_ELASTIC_TOKEN=base64(user:password) # optional, leave empty for open access
SIEM_ELASTIC_INDEX=pavri-alerts        # optional, default: pavri-alerts

Azure Sentinel (Log Analytics Data Collector API)

SIEM_SENTINEL_ENDPOINT=https://YOUR_WORKSPACE_ID.ods.opinsights.azure.com
SIEM_SENTINEL_WORKSPACE=YOUR_WORKSPACE_ID
SIEM_SENTINEL_TOKEN=YOUR_WORKSPACE_PRIMARY_KEY
SIEM_SENTINEL_INDEX=PavriAlerts        # optional, default: PavriAlerts

IBM QRadar (Syslog)

SIEM_QRADAR_ENDPOINT=your-qradar-host:514      # UDP by default
# For TCP syslog:
SIEM_QRADAR_ENDPOINT=tcp:your-qradar-host:514

TLS Requirements

Use endpoints with certificates trusted by the alert service. For private certificate authorities, install the appropriate CA certificate in the alert service trust store. Do not disable certificate verification for SIEM traffic.

---

Event Format

Splunk HEC Payload

{
  "time": 1742987200.0,
  "host": "pavri-alert-svc",
  "source": "pavri",
  "sourcetype": "pavri_alerts",
  "event": {
    "alert_id": "alert-abc123",
    "org_id": "org-tenant-1",
    "rule_name": "High Confidence Prompt Injection",
    "threat_type": "prompt_injection",
    "severity": "high",
    "confidence": 0.94,
    "action": "block",
    "agent_id": "agent-xyz",
    "session_id": "sess-123",
    "deep_link": "/sessions/sess-123?event=evt-456",
    "created_at": "2026-03-26T12:00:00Z"
  }
}

Elasticsearch Document

{
  "@timestamp": "2026-03-26T12:00:00.000Z",
  "alert_id": "alert-abc123",
  "org_id": "org-tenant-1",
  "threat_type": "prompt_injection",
  "severity": "high",
  "confidence": 0.94,
  "source": "pavri"
}

QRadar CEF (via syslog)

<9>1 2026-03-26T12:00:00Z pavri-alert-svc - - - - \
CEF:0|Pavri|PavriAlertService|1.0|prompt_injection|High Confidence Prompt Injection|8|\
src=pavri suser=agent-xyz msg=prompt_injection cs1Label=OrgId cs1=org-1 \
cs3Label=AlertId cs3=alert-abc123 rt=2026-03-26T12:00:00Z

---

Platform Setup

Follow the vendor's current installation and credential-management guidance for your approved SIEM deployment. Then configure Pavri with a dedicated, least-privilege credential or token and a trusted HTTPS endpoint.

For each platform:

1. Create a dedicated Pavri integration identity or ingestion token.
2. Restrict that identity to the required index, workspace, or listener.
3. Store credentials in your secret manager and inject them into the alert service through your deployment platform.
4. Send a test alert and confirm that the SIEM has indexed the expected fields.

Vendor pricing, trial terms, and local-install defaults change independently of Pavri. Consult the vendor directly for those details.

---

Helm Chart Configuration

Add SIEM environment variables to your Helm values.yaml:

services:
  alert:
    env:
      SIEM_SPLUNK_ENDPOINT: "https://splunk.internal:8088"
      SIEM_SPLUNK_TOKEN: ""  # Set via external-secrets or sealed-secrets
      SIEM_ELASTIC_ENDPOINT: "https://elastic.internal:9200"

For secrets, use Kubernetes secrets or the external-secrets-operator:

# values.yaml
services:
  alert:
    envFrom:
      - secretRef:
          name: pavri-siem-credentials

---

Observability

SIEM forwarding failures are logged at WARN level by the alert service:

alert-svc: SIEM forwarding enabled for 2 target(s)
siem: forward to splunk failed (alert=alert-abc123): splunk: unexpected status 503

SIEM failures do not appear as alert status=failed — the alert record's delivery status only reflects primary channel delivery.

---

Troubleshooting

Symptom	Likely Cause	Resolution
No events in Splunk	HEC not enabled, or wrong token	Settings → Data Inputs → HTTP Event Collector → verify token
splunk: unexpected status 401	Invalid HEC token	Regenerate token in Splunk HEC settings
splunk: unexpected status 400	Malformed event (sourcetype issue)	Verify SIEM_SPLUNK_INDEX matches a valid sourcetype
elastic: unexpected status 400	Wrong Content-Type or index routing	Check index template; re-create index if schema mismatch
sentinel: build signature: decode workspace key	Workspace key is not valid base64	Copy the primary key directly from Azure Portal (it is already base64)
No events in QRadar	UDP packet lost or wrong port	Try TCP: set SIEM_QRADAR_ENDPOINT=tcp:<host>:514
All SIEM errors but alerts still delivered	Expected — SIEM is fail-open	Check logs; primary alert channels are unaffected