Extension points

The package is built on two small contracts, so extending it means implementing an interface, not subclassing a framework.

• Custom formatter — implement StreamFormatter to emit a schema the five built-ins do not cover, and test it with the dogfooded seam.

The other contract, Cbox\Siem\Contracts\StreamSink, is the delivery seam. The core intentionally ships no real implementation (only FakeStreamSink for tests) — a production sink needs SSRF-safe egress, TLS, retries, and secret storage, which live in the Laravel wrapper cboxdk/laravel-siem. If you deliver outside Laravel, implement StreamSink yourself; treat the StreamTarget endpoint as opaque data and apply your own egress controls before dialing it.