Event sinks (SIEM export)

An event sink pushes Noxtica events to an HTTPS endpoint that you run, such as a SIEM collector. A workspace Admin creates the sink in Backoffice, arms it and checks delivery with a real test request. Use a sink when you want events in your own tooling without polling an API.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

• Where: Backoffice → Integrations & API → Event Sinks (/event-sinks). The page title is Event Sinks (SIEM). The sidebar item and the route need the Admin role.
• What a sink holds: a name (optional), an HTTPS endpoint, a format, a list of events, optional payload enrichments and a PII acknowledgement.
• Events: the sink subscribes to the same verdict event types as webhooks (see Webhooks), plus audit.log for the Backoffice audit stream and compliance.evidence for signed compliance evidence. A sink needs at least one event.
• Payload enrichment: the optional incident.summary token adds extra fields to every delivered record. It does not change which events are delivered.
• Signing: each sink has its own signing secret. Every delivery is an HMAC-signed HTTP POST, so your receiver can check it came from Noxtica.
• Two keys for delivery: creating a sink arms nothing. Delivery also needs your sink to be enabled and the platform event stream to be on for your workspace. If the page works but nothing arrives, the platform key is the usual reason; ask your account team.
• Limit: a workspace can hold up to 25 sinks.

Formats you can choose:

Prerequisites

• The Admin role and an authenticator app. Every change to a sink asks for a fresh MFA check. See Backoffice guide.
• A public https:// endpoint that is ready to receive live traffic. Loopback, private, link-local and metadata addresses are refused, and a URL with embedded credentials is refused.
• A receiver that can verify an HMAC signature and answer with a 2xx status.
• For Microsoft Sentinel: the Azure tenant ID, the application (client) ID and a secure secret reference. Do not paste a client secret into the form.
• A decision on raw IP addresses. Raw IP is included in a sink’s records only when your workspace stores raw IPs and you tick the PII acknowledgement on that sink. See Data retention, raw IP storage and data locations.

Steps

1. Create the sink

1. Open Event Sinks and complete the form.
2. Name (optional): for example “Splunk prod”.
3. HTTPS endpoint: for example https://siem.example.com/hec.
4. Format: choose from the table above.
5. Events: tick the events this sink receives. Add Payload enrichments if you want them.
6. Leave Acknowledge PII unticked unless you need raw IP addresses.
7. Select Create sink and enter your MFA code.

The toast reads: “Event sink created (disabled). Copy the signing secret now — it is shown only once.” A second sink with the same URL is refused with a 409 duplicate message.

2. Save the signing secret

The Signing secret box says it is “shown ONCE”. Copy it into your receiver’s configuration, then select Dismiss. Configure the receiver to verify the HMAC with it.

3. Verify each delivery in your receiver

Each request carries these headers:

Compute the HMAC over the timestamp, a dot and the raw request body. Answer quickly with a 2xx status and process the event afterwards. Each attempt has a 5 second timeout.

// Node.js receiver sketch
import { createHmac, timingSafeEqual } from 'node:crypto';

export function verify(rawBody, headers, secret) {
  const ts = headers['x-noxtica-timestamp'];
  const expected = 'sha256=' + createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest('hex');
  const got = headers['x-noxtica-signature'] ?? '';
  return got.length === expected.length && timingSafeEqual(Buffer.from(got), Buffer.from(expected));
}

Reject a request whose timestamp is far from your clock. Treat a repeated X-Noxtica-Delivery as a duplicate.

4. Arm the sink

The new sink has the status disabled. In the table, select Enable for the sink. The toast reads “Sink armed”. Select Disable to stop delivery without deleting the sink.

5. Send a real test request

Select Send real test request. The dialog warns that this sends a real signed HTTPS request from Noxtica to your endpoint right now and records it as a delivery attempt. Select Send real request. On success the toast reads “Test delivery accepted by the endpoint (HTTP ).” The test uses the same SSRF guard and 5 second timeout as live delivery. Marked test probes are excluded from the delivery objective figures.

6. Inspect deliveries

Select Deliveries for a sink. The list shows the newest deliveries with Status, Attempts, Last error and Created, and a Failed only filter. Summary figures show success rate, last success and last failure. A delivery counts as a success when your endpoint answers 2xx. A 4xx answer is final. A 5xx answer, a network error or a timeout is retried.

The page also shows a Seven-day delivery SLO card. It counts recorded terminal HTTP acceptance only. It is not proof of ingestion in your SIEM and not proof that no events were lost, and an empty or unavailable observation is not healthy.

When recovery is available for a retained failure, Redrive once queues a single real delivery to the sink’s current endpoint. The receiver may already have accepted the original event, so de-duplicate on X-Noxtica-Delivery. Redrive is single-use and depends on the feature being enabled for your organisation.

7. Rotate or delete

• Rotate secret: mints a new signing secret, shown once. The old secret stops working at once, so update your receiver first or accept failed verification until you do.
• Delete sink: removes the sink and stops all delivery to its URL. Deletion cannot be undone.

8. Microsoft Sentinel

Choosing Microsoft Sentinel adds fields for the Azure tenant ID, the application ID and a secret reference. Delivery uses an OAuth2 client-credentials flow instead of the HMAC signature. Noxtica refuses a form that carries an inline client secret.

Verify it works

• The sink row shows enabled and a Last delivery time after the test.
• The test toast shows an HTTP 2xx status.
• Deliveries lists the test request as delivered.
• Your receiver logged the request and the signature check passed.

Troubleshooting

Related

• Integrations and API pages: the map of this group.
• Webhooks: event types and the shared signing scheme.
• Audit log and data export: what the audit.log stream carries.
• Data retention, raw IP storage and data locations: raw IP storage.
• Roles and permissions: who can manage sinks.