SIEM Export

pub struct SiemEvent {
    /// The full ChioReceipt as stored in the kernel receipt database.
    pub receipt: ChioReceipt,
    /// Semantic receipt class used to prevent trace/advisory observations from
    /// being rendered as authorization decisions.
    pub receipt_kind: String,
    /// Runtime mediation boundary for this receipt.
    pub boundary_class: String,
    /// Human-facing semantic result label.
    pub result: String,
    /// True when the receipt id, receipt signature, and action parameter hash verify.
    pub authoritative: bool,
    /// True when the embedded receipt signature verifies against the embedded kernel key.
    pub signature_valid: bool,
    /// True when the receipt id matches the canonical receipt body.
    pub receipt_id_valid: bool,
    /// True when the action parameter hash matches the canonical action parameters.
    pub parameter_hash_valid: bool,
    /// True when the receipt signer is pinned as a trusted kernel signer.
    pub signer_trusted: bool,
    /// True only for authoritative Chio-mediated allow receipts at a prevent boundary.
    pub authorized: bool,
    /// Financial metadata extracted from `receipt.metadata["financial"]`, if present.
    pub financial: Option<FinancialReceiptMetadata>,
}

pub struct SiemConfig {
    /// Path to the Chio kernel receipt SQLite database.
    pub db_path: PathBuf,
    /// Interval between polls for new receipts. Default: 5 seconds.
    pub poll_interval: Duration,
    /// Maximum number of receipts to read per poll cycle. Default: 100.
    pub batch_size: usize,
    /// Maximum number of retry attempts per exporter before DLQ. Default: 3.
    pub max_retries: u32,
    /// Base backoff in milliseconds for exponential retry (actual: base * 2^attempt). Default: 500.
    pub base_backoff_ms: u64,
    /// Maximum capacity of the dead-letter queue. Default: 1000.
    pub dlq_capacity: usize,
    /// Optional per-exporter batch rate limit. None means unlimited.
    pub rate_limit: Option<RateLimitConfig>,
    /// Kernel public keys trusted to produce authoritative receipts.
    pub trusted_kernel_keys: BTreeSet<String>,
    /// Explicit read authority for local receipt polling. SIEM polling is an
    /// operator surface and must not run with tenant-scoped authority.
    pub read_context: ReceiptReadContext,
    /// Optional path to the SIEM-owned RW cursor store (per-exporter high-water
    /// mark). When set, delivery is at-least-once: the read cursor resumes at
    /// min(acked_seq) so a failed exporter forces bounded redelivery instead of
    /// a silent skip. None keeps the legacy advance-regardless behavior. Distinct
    /// from the read-only receipt DB.
    pub cursor_db_path: Option<PathBuf>,
}

let (cancel_tx, cancel_rx) = tokio::sync::watch::channel(false);
manager.run(cancel_rx).await;

// To stop gracefully:
let _ = cancel_tx.send(true);

// Inspect DLQ depth from operator tooling:
let dlq_len = manager.dlq_len();

use chio_egress_contract::HttpEgressContract;
use chio_siem::exporters::splunk::{SplunkConfig, SplunkHecExporter};
use std::collections::BTreeSet;
use std::time::Duration;

// Pin the exact scheme and authority the exporter may reach.
// SplunkHecExporter::new rejects a missing contract with ExportError::HttpError.
let egress_contract = HttpEgressContract {
    tenant_egress_namespace: "siem:splunk:splunk.larkfield.example:8088".to_string(),
    allowed_schemes: BTreeSet::from(["https".to_string()]),
    allowed_authority_set: BTreeSet::from(["splunk.larkfield.example:8088".to_string()]),
    deny_loopback: true,
    deny_link_local: true,
    deny_ipv6_ula: true,
    max_redirect_chain: 3,
    max_response_bytes: 1024 * 1024,
};

let config = SplunkConfig {
    endpoint: "https://splunk.larkfield.example:8088".to_string(),
    hec_token: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx".to_string(),
    sourcetype: "chio:receipt".to_string(),
    index: Some("chio_audit".to_string()),
    host: Some("chio-node-01".to_string()),
    timeout: Duration::from_secs(30),
    egress_contract: Some(egress_contract),
};

let exporter = SplunkHecExporter::new(config)?;
manager.add_exporter(Box::new(exporter));

sourcetype="chio:receipt" event.decision.verdict="deny" event.decision.guard="kernel"
| stats sum(event.metadata.financial.attempted_cost) as total_attempted
        by event.capability_id
| sort - total_attempted

use chio_egress_contract::HttpEgressContract;
use chio_siem::exporters::elastic::{
    ElasticAuthConfig, ElasticConfig, ElasticsearchExporter,
};
use std::collections::BTreeSet;
use std::time::Duration;

let egress_contract = HttpEgressContract {
    tenant_egress_namespace: "siem:elastic:es.larkfield.example:9200".to_string(),
    allowed_schemes: BTreeSet::from(["https".to_string()]),
    allowed_authority_set: BTreeSet::from(["es.larkfield.example:9200".to_string()]),
    deny_loopback: true,
    deny_link_local: true,
    deny_ipv6_ula: true,
    max_redirect_chain: 3,
    max_response_bytes: 1024 * 1024,
};

let config = ElasticConfig {
    endpoint: "https://es.larkfield.example:9200".to_string(),
    index_name: "chio-receipts".to_string(),
    auth: ElasticAuthConfig::ApiKey("base64encodedkey==".to_string()),
    // or Basic { username, password }
    timeout: Duration::from_secs(30),
    egress_contract: Some(egress_contract),
};

let exporter = ElasticsearchExporter::new(config)?;
manager.add_exporter(Box::new(exporter));

POST chio-receipts/_search
{
  "query": {
    "bool": {
      "filter": [
        { "term": { "decision.verdict": "deny" } },
        { "range": { "timestamp": { "gte": "now-24h/h" } } }
      ]
    }
  },
  "aggs": {
    "by_guard": {
      "terms": { "field": "decision.guard", "size": 20 }
    }
  }
}

POST chio-receipts/_search
{
  "size": 0,
  "query": { "term": { "decision.verdict": "allow" } },
  "aggs": {
    "by_subject": {
      "terms": {
        "field": "metadata.financial.root_budget_holder",
        "size": 10
      },
      "aggs": {
        "spend": {
          "sum": { "field": "metadata.financial.cost_charged" }
        }
      }
    }
  }
}