Data and records Log streaming
Log streaming
Log streaming sends this workspace's audit trail, alerts and enforcement records to your SIEM as they happen. There are three kinds of destination: Splunk's HTTP Event Collector, syslog over TLS, and a signed HTTPS webhook. A workspace can have up to 50.
Who can do it
Reading the page needs Manage workspace settings (settings:manage) or View the audit log (audit_log:read). Adding, editing, testing and deleting a destination need Manage workspace settings, which only the Owner role holds. Without it, the footer says "Changing log streams needs the settings:manage permission."
Add a destination
- Open Settings › Data › Log streaming and choose Add destination.
- Destination. Choose Splunk, Syslog or HTTPS webhook.
- Connection. Fill in the kind's fields (below). Choose Continue.
- What to send. Choose a starting point, the categories, and the format. Choose Continue.
- Test. Choose Send test event. Nothing is saved until you choose Add destination.
Events from the moment you add it are sent to it. Nothing earlier is sent.
The connection, by kind
| Kind | Fields | How it is sent |
|---|---|---|
| Splunk | HEC URL, HEC token, Index (optional) | A POST to the URL's /services/collector/event, with Authorization: Splunk and your token. One JSON envelope per event. |
| Syslog | Host, Port, CA certificate (optional) | RFC 5424 messages, octet-counted as in RFC 5425, over one TLS connection per batch. The port is 6514 if you leave it empty. Without a CA certificate, the server's certificate must chain to a public root. |
| HTTPS webhook | URL, Signing secret | A POST of a JSON body {"events": [...]}, with an X-Oxel-Signature header. |
Every kind also has a Name. Leave it empty and the console names the destination after its kind and address.
The address must be https:// and must be a public address. Loopback, private, link-local and similar addresses are refused, and so is a URL with credentials in it. Calls time out after ten seconds, and redirects are not followed.
Verifying a webhook
The signing secret is made in your browser, as 32 random bytes in hex, and shown once. Tick I have stored this to continue. Oxelone keeps it sealed and can never show it again. Choose New secret on an edit to make another.
The header reads X-Oxel-Signature: t=<unix time>,v1=<hex>. v1 is an HMAC-SHA256, keyed with the signing secret, over the characters of t, a full stop, and the raw body. Because the time is signed with the body, a captured call cannot be replayed under a new time.
What to send
Start from sets the categories and the severity in one go.
| Starting point | Categories | Alert severity | Warnings |
|---|---|---|---|
| Baseline | Audit, Access, Detections, Enforcement | Medium and above | Off |
| Everything | All eight | Low and above | On |
| Custom | Whatever you tick | Your choice | Your choice |
| Category | What it holds |
|---|---|
| Audit | Changes to policies, engines and settings. |
| Access | Sign-ins, members, keys and content reveals. |
| Detections | Alerts and issues. |
| Enforcement | Blocks and the actions connections took. |
| Fleet | Machine enrolment, configuration and lifecycle. |
| Interactions | AI interactions, as metadata. |
| File events | AI tool files appearing and changing. |
| Connections | Connection syncs and changes. |
Each category shows its volume over the last 7 days. Detections has a severity floor: Low, Medium, High or Critical. Enforcement has a Warnings switch.
Include content is off by default, which sends metadata only. Turning it on sends interaction text, after this workspace's redaction, and is recorded in the audit log.
Format is JSON (OCSF) or CEF. The JSON is shaped after OCSF 1.3.0, with everything specific to Oxelone under unmapped.oxel. CEF is one line per event.
Watch it deliver
Each destination is a row with a status, a switch and a ⋯ menu.
| Status | Meaning |
|---|---|
| Delivering | Events are reaching it. |
| Retrying | A batch failed. The row says how many are waiting and when the next try is. |
| Failing | Five failures in a row. |
| Paused | You switched it off. |
A failed batch stays where it was and is tried again after 30 seconds, doubling each time up to ten minutes. A delivered batch resets the count. The switch saves at once.
The menu has Edit, Send test event and Delete…. Deleting says: nothing more is sent to it; what it already received stays where it is; its token or secret is deleted and cannot be recovered. A secret you leave empty on an edit is kept, and a new URL needs the token or secret again.
The token or secret is stored encrypted. Only its last four characters are kept in the clear, so the row can say "Stored, ends …".
Every setting
| Setting | What it does | Default |
|---|---|---|
| Name | Labels the destination. 1 to 120 characters. | The kind and address |
| Categories | What is sent. At least one. | Baseline |
| Alert severity at or above | The floor for Detections. | Medium |
| Warnings | Whether Enforcement includes warnings. | Off |
| Include content | Whether interaction text is sent. | Off |
| Format | JSON (OCSF) or CEF. | JSON (OCSF) |
| Send to (the row's switch) | Turns delivery on or off. | On |
When it goes wrong
- The test event was delivered. The destination accepted it.
- The destination could not be reached., The destination's name did not resolve., The destination answered … (with the status code) and The TLS handshake failed: …. The test failed. Check the address, the token, the certificate and any firewall that blocks Oxelone.
- That address isn't allowed for a log stream. The address is not public.
- A log stream's address is https://. Use https.
- That is not an address. Check the URL or host.
- The HEC token is required. / The signing secret is required. Fill the field.
- A signing secret is at least 32 characters. Use the generated one.
- The CA is a PEM certificate. Paste a certificate that starts
-----BEGIN CERTIFICATE-----. - Choose at least one category. Tick one.
- A workspace has at most 50 log streams. Delete one first.
- A new URL needs the HEC token again. / A new URL needs a new signing secret. Enter it.
- This deployment has no credential key, so Splunk and webhook destinations cannot be added. Whoever runs your deployment must set a credential key. Syslog can still be added.
- The categories could not be read, so a destination cannot be added until the page is reloaded. Reload.
- Log streaming is read with settings:manage or audit_log:read. You lack both.
With the API
Not available with an API key.