Etminan emits one event per integrity finding and per signed operator action over syslog, in the formats Splunk and QRadar already parse — CEF and LEEF. This is the consuming-side reference: how to turn it on, the event model, the field dictionary, real sample events, and the normalization mappings (Splunk CIM, QRadar QID) that make findings raise proper alerts and offenses.
Supported today. Both SIEMs ingest Etminan's output generically right now — Splunk parses CEF, QRadar natively parses LEEF (which is exactly why Etminan emits LEEF for it). This guide plus that generic ingestion is the supported path. A certified Splunk Technology Add-on and QRadar DSM are a planned follow-on (see the end of the page) — this page is the field-level contract both will follow.
SIEM output is off by default. Set the format on the verifier and events start flowing on the next check — no new process, no in-process HTTP, no third-party dependency.
Events are written to the local /dev/log socket by default (your
syslog daemon forwards them onward), or sent as UDP to
ETMINAN_SIEM_SYSLOG_ADDR=host:port. Facility is
local0; syslog severity maps
critical → err, warning → warning,
action → info. One event is emitted per finding and per
signed operator action.
Everything Etminan emits is one of two categories, split on the cat
(CEF) / cat (LEEF) field so your SIEM can route them to different
data models.
| Event | cat | When |
|---|---|---|
| finding | finding | an integrity check result (a run/check finding) |
| operator-action | operator-action | a signed trust-changing action, taken from the hash-chained audit log |
The <version> field is the CEF/LEEF device-version header — it
carries the running etminan-verifier version at emit time.
etminanCEF:0|Etminan|etminan-verifier|<version>|<sigId>|<name>|<sev 0-10>|<extension>LEEF:2.0|Etminan|etminan-verifier|<version>|<eventId>|x09|<TAB-separated attrs>The field names are stable. Signature and payload blobs are deliberately never placed on the wire — they live in the hash-chained audit log, not the SIEM event.
| Field (CEF / LEEF) | finding | operator-action |
|---|---|---|
| sigId / eventId | the finding kind (pcr-mismatch, template-hash-mismatch, unexpected-pcr-selection, sla-exceeded, pending-overflow, plugin-failure, check-error, audit-chain-invalid, …) |
the audit action (host_enrolled, baseline_approved, baseline_rejected, baseline_exclusion_created/_revoked, operator_key_authorized/_revoked/_rotated, tls_cert_rotated, ak_rotated, profile_assigned) |
| cat | finding | operator-action |
| dhost / dst | monitored host id | resource acted on (host id, or a key for registry actions) |
| cs1 (cs1Label=kind) / kind | the finding kind | — |
| suser / usrName | — | the signing operator key (hex) |
| act | — | the audit action |
| msg | the finding text | compact k:v,k:v detail summary (blobs dropped) |
| severity | CEF numeric (critical=10, warning=5, action=3); LEEF sev = the raw word | same |
Real event shapes for both categories, in both formats. The
<version> field is the running verifier version.
CEF:0|Etminan|etminan-verifier|<version>|pcr-mismatch|Host integrity finding|10|dhost=web-01 cat=finding cs1Label=kind cs1=pcr-mismatch msg=quoted PCR10 digest does not match the replayed IMA measurement logCEF:0|Etminan|etminan-verifier|<version>|baseline_approved|Signed operator action|3|suser=3a1f9c2b…e7 cat=operator-action act=baseline_approved dhost=web-01 msg=path:/usr/local/bin/app,reason:scheduled deploy 4821LEEF:2.0|Etminan|etminan-verifier|<version>|pcr-mismatch|x09|cat=finding→dst=web-01→kind=pcr-mismatch→sev=critical→msg=quoted PCR10 digest does not match the replayed IMA measurement logLEEF:2.0|Etminan|etminan-verifier|<version>|baseline_approved|x09|cat=operator-action→usrName=3a1f9c2b…→act=baseline_approved→dst=web-01→sev=action→msg=path:/usr/local/bin/app,reason:scheduled deploy 4821
Ingest as CEF — a dedicated sourcetype = etminan:cef is
recommended. Split by cat and normalize: findings to
Alerts, operator actions to Change (so registry/baseline changes surface in
Splunk ES change analysis).
| Etminan | Splunk CIM field | Data model |
|---|---|---|
| cat=finding events | — | Alerts (and/or Endpoint integrity) |
| dhost | dest, dvc | Alerts / Endpoint |
| cs1 (kind) | signature, category | Alerts |
| CEF severity | severity | Alerts |
| msg | description | Alerts |
| cat=operator-action events | — | Change |
| suser | user | Change |
| act | action / change_type | Change |
| dhost | object / dest | Change |
Until the certified TA ships, a few field aliases (dhost→dest,
suser→user) plus event tags get you CIM-compliant.
LEEF is parsed natively — add a Log Source of type LEEF. A DSM / Log-Source Extension assigns
each eventId a QID → category + severity so findings raise
proper offenses.
| Etminan eventId | QRadar category (high / low-level) | Severity |
|---|---|---|
| pcr-mismatch, template-hash-mismatch, unexpected-pcr-selection, audit-chain-invalid | Suspicious Activity → System Integrity Violation | High (8–10) |
| operator-rejected | Policy → Host-Based Policy Violation | High |
| sla-exceeded, pending-overflow, plugin-failure, check-error | Potential Exploit / Policy → Warning | Medium |
| operator-action eventIds (baseline_approved, operator_key_*, *_rotated, …) | Audit → Configuration / Authentication Change | Low–Medium |
Set ETMINAN_SIEM_FORMAT (and
ETMINAN_SIEM_SYSLOG_ADDR for a remote collector), restart the
verifier, and confirm events reach the SIEM.
Set the sourcetype, apply the field aliases + CIM tags above (or install the certified TA when available). Validate against the Change / Alerts data models.
Add the LEEF Log Source; import the QID map / DSM extension when available — generic LEEF parsing works in the meantime.
Everything above works today with generic CEF/LEEF ingestion. These follow-ons are honest about what they need before they can ship as “supported” rather than untested-blind.
JSON output — a newline-delimited JSON event per finding and per signed action, over the same syslog transport, for generic structured-log ingesters (Elasticsearch, Loki, Vector, Fluent Bit). Its flat, Etminan-defined schema will be documented on this page when it lands.
Certified Splunk TA + QRadar DSM — a packaged Splunk Technology Add-on
(props.conf/transforms.conf + CIM tags)
and a QRadar DSM / Log-Source Extension (QID map), each following the field dictionary above.
Gated on access to Splunk (+ Splunk ES) and QRadar test instances so they can be validated
against real ingestion rather than shipped blind. Running one of those and want to help?
Tell us.