Agent visibility in the SIEM you already run
Forward every decision. Return verdicts through the push API.
Immediate visibility into agent connections and tamper-evident evidence.
| Timestamp | Action | Site | Query Name | Source IP | Reason |
|---|---|---|---|---|---|
| 2026-09-15 14:02:11 | accept | research-agent | api.openai.com | 10.40.2.17 | allow list |
| 2026-09-15 14:02:11 | accept | research-agent | api.tavily.com | 10.40.2.17 | allow list |
| 2026-09-15 14:02:14 | greywall | research-agent | cdn-assets-sync.top | 10.40.2.17 | first seen, held 24h |
| 2026-09-15 14:02:14 | block | research-agent | dns.google | 10.40.2.17 | category: DoH provider |
| 2026-09-15 14:02:19 | threat | research-agent | update-check.pw | 10.40.2.17 | feed: c2-indicators |
| 2026-09-15 14:02:31 | accept | finance-agent | api.stripe.com | 10.40.3.8 | allow list |
The agents are in production and the SOC has no feed
Application logs describe what the agent did. Nothing describes where it tried to go. When an incident involves an agent, the first question is which destinations it reached and when, and the answer is in a resolver that does not log per agent.
No per-agent egress record
Firewall logs show a pod IP and a destination IP. Not the agent role, not the hostname, not why.
Detection without response
A SIEM alert on a bad domain needs a control that can block it in the next minute, everywhere.
Evidence assembled after the fact
Timelines rebuilt from partial logs a week later.
Feed in, verdict out
Forward events
Syslog to your collector, CEF for ArcSight and Sentinel, JSON for the data lake, API pull for custom pipelines.
Alert on two signals
A spike of first-seen names on one policy, and any DNS traffic to a resolver other than Securd.
Push the verdict
The SOAR playbook confirms the indicator and pushes it to the block list. Every policy enforces on the next publish.
Security operations capabilities
Every decision, every field
Timestamp, action, reason, site, client, name, categories, rank, answer, ASN and country.
SIEM guides
Splunk, Sentinel, Elastic, Datadog, Google SecOps, QRadar, Sumo, Cribl and OpenTelemetry, each with a verification query.
Push API
Verdicts from Splunk SOAR, XSOAR, Tines or Torq into a block list with confidence and expiry.
Signed webhooks
threat.detected, config.published, config.failed, list.updated, feed.polled, device.registered. HMAC signed.
Threat hunting
First-seen by site, rank zero names, DoH provider attempts, sinkhole hits. Saved searches on the integrations pages.
Change log
Every configuration change with user and timestamp, so the response is as auditable as the detection.
A threat event, signed
Verify the HMAC, open the case, push the verdict. Receiver samples for Python, Node and Go are in the developer library.
POST /securd/events
X-Securd-Signature: sha256=3f1c...
{
"event": "threat.detected",
"timestamp": "2026-09-15T14:02:19Z",
"data": {
"site_name": "research-agent",
"domain": "update-check.pw",
"action": "threat",
"reason": "feed: c2-indicators",
"client_ip": "10.40.2.17"
}
}Questions teams ask
Which SIEMs are supported?
Any that ingests syslog, CEF or JSON. Guides with a verification query exist for the platforms listed on the integrations page.
How do we detect a bypass?
Restrict port 53 and 853 at the firewall to the Securd resolvers and log the drops. Block the DoH provider category in every policy. Both produce events.
Is the log tamper-evident?
Events are written once and forwarded. The change log records every configuration change. Retain both in your SIEM of record.
See agent events in your SIEM this week
One syslog destination, one verification query, and the SOC has the feed.