Skip to content
← SIEM for Laravel 0.2.0 View on GitHub

Extension points

Cbox SIEM for Laravel

Cbox SIEM for Laravel is the delivery engine that ships normalized security events to real SIEMs — Splunk HEC, Elastic (ECS), Graylog (GELF), ArcSight/syslog (CEF), any HTTP JSON collector, or Datadog Logs — and archives them to Amazon S3 (or an S3-compatible store) and Google Cloud Storage, durably and safely.

It is the Laravel wrapper over the framework-agnostic cboxdk/siem core. The two tiers split cleanly:

The two-tier story

  • cboxdk/siem (core) owns the shape of the data: the normalized SiemEvent value object and the pure, deterministic formatters that turn one event into the exact bytes each SIEM ingests. It is zero-dependency and does no I/O — it never dials a network or holds a secret.
  • cboxdk/laravel-siem (this package) owns delivery: a transactional outbox, a queued pump that batches and ships, SSRF-guarded HTTP egress, encrypted destination secrets, per-field PII redaction, retry/backoff/dead-letter, and a per-stream circuit breaker.

A third tier consumes this one: an audit binding (in cboxdk/laravel-id) writes an audit record and an outbox row in the same transaction, so its audit trail streams to a customer's SIEM at-least-once. That binding is not part of this package.

Mental model

your app ──emit──▶ StreamDispatcher ──insert (in your txn)──▶ outbox (stream_deliveries)
                                                                    │
                                            queued PumpStreamDeliveries (per stream)
                                                                    │
                        redact ─▶ core formatter ─▶ DestinationRouter ─▶ your SIEM / bucket
                                           (HTTP, Datadog, S3, GCS sinks — SSRF-guarded, TLS-on, batched)

Delivery is deny-by-default: with no enabled LogStream, nothing is written and nothing is sent. Delivery is at-least-once and unordered — see outbox and semantics.

Sections

  • Quickstart — configure a stream and deliver in one read.
  • Requirements — PHP, Laravel, and dependency versions.
  • Core concepts — the delivery engine and its semantics.
  • Cookbook — Splunk, Elastic, Datadog, Amazon S3, Google Cloud Storage.
  • Extension points — custom sinks and destinations.
  • Security — egress/SSRF, secrets, and redaction.

Where things live

This package documents only its own delivery layer. The event model, the formatters, and their escaping/threat model are documented in cboxdk/siem.

Next → Quickstart