siemexport

Overview ¶

Package siemexport provides a background goroutine that continuously exports new audit log entries to an external SIEM or webhook endpoint.

Activation: set AUDIT_EXPORT_URL to an HTTP(S) endpoint. The exporter reads entries created after the last successfully-exported timestamp and POSTs them as newline-delimited JSON (one entry per line, content-type application/x-ndjson). An optional AUDIT_EXPORT_SECRET sets a Bearer token on the Authorization header.

The exporter starts from the most-recent audit entry at startup (no historical re-export on first run) and advances its bookmark atomically after each successful delivery.