SIEM for Laravel
The SIEM log-streaming delivery engine for Laravel: a durable transactional outbox, queued batched delivery with retry and dead-letter, a per-stream circuit breaker, SSRF-guarded egress, encrypted secrets and per-field PII redaction.
SIEM for Laravel is the delivery engine that ships normalized security events to Splunk HEC, Elastic ECS, Graylog GELF, ArcSight CEF, or any HTTP JSON collector. It is the Laravel wrapper over the framework-agnostic SIEM Core. The core owns the event model and the formatters, the shape of the data; this package owns delivery, the network, the durability and the secrets. It writes events to a transactional outbox in your own DB transaction, then a queued pump batches, redacts, formats and ships them off the request thread.
Durable Delivery
Transactional Outbox
The outbox row commits inside your own DB transaction, so a rolled-back caller leaves no orphan event. A cheap insert on the request thread, delivery happens later.
Queued & Batched
All delivery is queued, so it never blocks the request. Triple-bounded batches by records, bytes and age keep each shipment sane.
Retry & Dead-Letter
Bounded exponential backoff with jitter and a hard retry cap into a dead-letter queue, plus a bounded outbox with an explicit backpressure policy.
Per-Stream Circuit Breaker
A failing destination trips its own circuit breaker instead of dragging down every other stream, so one broken SIEM does not stall the rest.
Safe Egress
SSRF-guarded and DNS-pinned HTTP, TLS verification always on, destination secrets encrypted at rest with the Laravel encrypter and scrubbed from logs.
PII Redaction
Per-field redaction (drop or hash) runs before formatting, so sensitive fields never reach the wire or a SIEM in the clear.
What it guarantees
Deny-by-default: no enabled stream, nothing delivered. At-least-once and unordered: duplicates are possible, so dedup by event id. Delivery never blocks the request, everything is bounded, and egress is SSRF-guarded with secrets encrypted at rest.
Five destinations
Register a destination and its endpoint is SSRF-checked and its secret encrypted. Splunk HEC ships NDJSON with a Splunk token, Elastic takes ECS JSON documents, Graylog uses GELF 1.1 over HTTP (never UDP), ArcSight takes CEF lines over HTTP, and a generic JSON destination hits any HTTP collector. An audit binding in Identity for Laravel consumes this layer to stream a tamper-evident audit trail.
Testable end to end
Compose InteractsWithLogStreams into your TestCase to run the whole pipeline in memory: fakeStreamSink() binds an in-memory sink, createLogStream() registers through the real registry, and pumpStream() runs a delivery cycle synchronously.