> ## Documentation Index
> Fetch the complete documentation index at: https://explore.airia.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SIEM Log Forwarding

Forward platform audit and security events to your SIEM in real time over syslog, and optionally ship logs to an AWS S3 bucket for retention and analysis.

Navigate to **Settings → Log Management → SIEM** to configure forwarding. Access requires the **SIEM** settings permission (held by Platform Admin, Admin, and other administrative roles by default).

## Syslog forwarding

| Setting                | Description                                                                                                               |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| Server URL             | Hostname or IP of your syslog server.                                                                                     |
| Port                   | Syslog listening port (1–65535).                                                                                          |
| Protocol               | **TCP** (recommended) or **UDP**. UDP cannot confirm delivery and silently drops messages larger than a single datagram.  |
| Format                 | **RFC5424** (modern, structured) or **RFC3164** (legacy BSD).                                                             |
| Framing                | TCP message delimiting — see [Message framing](#message-framing).                                                         |
| Use TLS                | Encrypt the TCP connection.                                                                                               |
| Ignore TLS certificate | Skip certificate validation. Leave off in production so untrusted certificates are rejected.                              |
| Forward audit logs     | Forward platform audit-log events (logins, configuration changes, resource create/edit/delete) to the syslog destination. |

Use **Test Connection** to send a test message to the configured destination and confirm reachability before saving.

## Message framing

When syslog runs over TCP, multiple messages share one connection, so the receiver needs to know where each message ends. The platform supports two methods (RFC 6587):

* **Octet-counting** (default) — each message is prefixed with its byte length. Used by RFC 5425/6587; accepted by rsyslog, Splunk, and most modern SIEMs.
* **Newline (LF)** — each message is terminated by a line feed. Choose this for receivers that expect non-transparent framing, such as **syslog-ng's default `network()` source** and many **legacy RFC3164** servers, which mis-parse octet-counted frames.

Framing applies to **TCP only**.

## Event content and routing

Forwarded events contain **security and operational metadata only** — never message content. Request and response bodies (prompts and completions), conversation history, tool-call arguments, guardrail-matched content, and request/response headers (including `Authorization` and API keys) are omitted or redacted before an event leaves the platform.

Each event is tagged so your SIEM can route or drop it **from the syslog header alone, without parsing the message body**:

* **Severity (PRI)** — set on every event, in both RFC5424 and RFC3164. Security and compliance events (audit logs, guardrail and tool-constraint violations, shadow-AI events) are emitted at **Warning**; high-volume operational telemetry (gateway requests and usage, pipeline executions) at **Informational**. Filter on severity to keep security events and drop operational noise.
* **Message ID (MSGID)** — RFC5424 only. Carries the exact event category (see table below) for precise routing. RFC3164 has no MSGID field; on that format, route by severity instead.

| Category                  | MSGID                 |
| ------------------------- | --------------------- |
| Audit log                 | `audit_log`           |
| Guardrail violation       | `guardrail_violation` |
| Tool-constraint violation | `tool_constraint`     |
| Shadow-AI event           | `shadow_ai`           |
| Gateway request telemetry | `gateway_telemetry`   |
| Gateway usage             | `gateway_usage`       |
| Pipeline execution        | `pipeline_execution`  |

## AWS S3 log shipping

Optionally ship SIEM logs to an S3 bucket in addition to (or instead of) syslog.

| Setting              | Description                                                                                                                       |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Bucket name / Region | Target S3 bucket and AWS region.                                                                                                  |
| Key prefix           | Object key prefix for shipped logs (default `logs/`).                                                                             |
| Authentication       | **Role ARN** (recommended — cross-account `AssumeRole`, with an optional external ID) or **access keys** via a stored credential. |
| Rolling interval     | How often a new log object is rolled (Minute, Hour, Day, Month, Year).                                                            |

Use **Test Connection** in the S3 section to verify the bucket is reachable with the configured credentials.