{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"OpenTelemetry SIEM Integration","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"opentelemetry-siem-integration","__idx":0},"children":["OpenTelemetry SIEM Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Push Capsule detections, findings, and policy violations to any OpenTelemetry (OTLP) logs endpoint: your own OpenTelemetry Collector, or an observability or SIEM backend that accepts OTLP directly. Put a Collector in front to route events anywhere it can export."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule sends each event as an OTLP log record as it is produced, over OTLP/HTTP with JSON encoding, gzip-compressed."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Event type"},"children":["Event type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What gets exported"},"children":["What gets exported"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Real-time detections raised on agent activity, with full event context"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Posture and configuration findings across your AI inventory"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Guardrail and policy breaches, with the full evidence the decision was made on"]}]}]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Capsule event (detection / finding / policy violation)\n  → OTLP log record, body = the full Capsule event envelope\n  → POST <endpoint>/v1/logs, gzipped JSON, with your headers\n  → your OpenTelemetry Collector or OTLP-compatible backend\n"},"children":[]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is separate from ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Notifications"]},". Notifications push individual alerts to a channel; the SIEM integration streams the full, verbose event record for ingestion and long-term correlation."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OTLP/HTTP JSON only."]}," Protobuf encoding and OTLP/gRPC are not supported. An endpoint that only accepts protobuf answers with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["HTTP 415"]},". Put a Collector in front of it: the Collector receives JSON and re-exports in whatever protocol the backend needs."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule"]}," account with admin access, and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SIEM"]}," tab visible under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An OTLP/HTTP logs endpoint reachable from the internet over ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["HTTPS"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The credentials your endpoint expects, as one or more request headers"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-prepare-your-endpoint","__idx":3},"children":["Step 1: Prepare your endpoint"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"endpoint-url","__idx":4},"children":["Endpoint URL"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule accepts either shape:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["A collector base URL"]},", the value you would put in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OTEL_EXPORTER_OTLP_ENDPOINT"]},". Capsule appends ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/logs"]},". For example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://otel-collector.acme.com:4318"]}," is posted to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://otel-collector.acme.com:4318/v1/logs"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The full logs URL"]},", the value you would put in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OTEL_EXPORTER_OTLP_LOGS_ENDPOINT"]},". A URL that already ends in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/logs"]}," is used as is."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The endpoint must be ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]},". Redirects are not followed, so point Capsule at the receiver itself rather than at a URL that forwards to it."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"headers","__idx":5},"children":["Headers"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Headers are sent with every request, and are usually how the endpoint authenticates Capsule. They are write-only: Capsule stores them encrypted and never shows the values again. You can add up to 20. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Content-Type"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Content-Encoding"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Content-Length"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Host"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Transfer-Encoding"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Connection"]}," are set by Capsule and cannot be overridden."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Destination"},"children":["Destination"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Endpoint"},"children":["Endpoint"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Header"},"children":["Header"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["OpenTelemetry Collector with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["bearertokenauth"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://<your-collector>:4318"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization: Bearer <token>"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Grafana Cloud OTLP"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://otlp-gateway-<zone>.grafana.net/otlp"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization: Basic <base64 of instanceId:token>"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Honeycomb"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://api.honeycomb.io"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["x-honeycomb-team: <api key>"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For Grafana Cloud, the instance ID, zone, and a token with write access are on the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OpenTelemetry"]}," tile of your Grafana Cloud stack. Encode the pair with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["echo -n '<instanceId>:<token>' | base64"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A collector that authenticates by network rather than by header, for example one behind an IP allow-list, needs no headers at all."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"example-opentelemetry-collector","__idx":6},"children":["Example: OpenTelemetry Collector"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A minimal ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://github.com/open-telemetry/opentelemetry-collector-contrib"},"children":["OpenTelemetry Collector Contrib"]}," config that accepts Capsule's events with a bearer token and prints them. Replace the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["debug"]}," exporter with the exporter for your backend once you have seen events arrive."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"yaml","header":{"controls":{"copy":{}}},"source":"extensions:\n  bearertokenauth:\n    token: ${env:CAPSULE_OTLP_TOKEN}\n\nreceivers:\n  otlp:\n    protocols:\n      http:\n        endpoint: 0.0.0.0:4318\n        auth:\n          authenticator: bearertokenauth\n        tls:\n          cert_file: /etc/otelcol/tls/server.crt\n          key_file: /etc/otelcol/tls/server.key\n\nexporters:\n  debug:\n    verbosity: detailed\n\nservice:\n  extensions: [bearertokenauth]\n  pipelines:\n    logs:\n      receivers: [otlp]\n      exporters: [debug]\n","lang":"yaml"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In Capsule, add the header ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," with the value ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Bearer <the CAPSULE_OTLP_TOKEN value>"]},". If TLS terminates at a load balancer in front of the Collector, drop the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tls"]}," block and give Capsule the load balancer's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]}," URL."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-create-the-siem-integration-in-capsule","__idx":7},"children":["Step 2: Create the SIEM integration in Capsule"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In Capsule, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → SIEM"]}," and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add integration"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Destination"]}," to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OpenTelemetry (OTLP)"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enable the event types you want: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Choose an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Event detail"]}," level:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Full"]}," sends the whole envelope, matching the S3 and Splunk exports."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Compact"]}," omits activity message bodies. Use it where your backend bills by ingested volume and the transcript is not what you search on."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Paste the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Endpoint"]}," from Step 1."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Headers"]},", click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add header"]}," for each header your endpoint needs, and enter its name and value."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},", then ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["enable"]}," the integration. A new integration starts disabled and exports nothing until you turn it on."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you edit the integration later, saved header values stay hidden. Leave ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Headers"]}," empty to keep them. Entering any header replaces the whole saved set, so enter every header the endpoint needs, not only the one you are changing."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-verify","__idx":8},"children":["Step 3: Verify"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the row menu's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Send test event"]},". Capsule posts a single connection-test log record to your endpoint and reports whether it was accepted, with the endpoint's error if it was not. The record is a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule.detection.created"]}," event whose detection type is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_CONNECTION_TEST"]},", so it is easy to filter out. With the Collector example above, the record appears in the Collector's output."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delivery"]}," column on the SIEM list shows the outcome of the most recent attempt, and the details drawer shows the last error in full."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-arrives-at-your-endpoint","__idx":9},"children":["What arrives at your endpoint"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each request is one OTLP ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ExportLogsServiceRequest"]}," carrying one resource, one scope, and a batch of log records."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"log-record-mapping","__idx":10},"children":["Log record mapping"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"OTLP field"},"children":["OTLP field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Resource attribute ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["service.name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Resource attribute ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule.tenant.id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your Capsule tenant ID"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Scope ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["name"]}," / ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["version"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule.siem-export"]}," / ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["2"]},", the envelope schema version"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["timeUnixNano"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["When the detection, finding, or policy violation was created"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["observedTimeUnixNano"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["When Capsule exported the event"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["severityNumber"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["severityText"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Policy violations only, see below"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Attribute ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event.name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule.detection.created"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule.finding.created"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule.policy_violation.created"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Attribute ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule.event.id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The ID of the detection, finding, or policy violation"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Attribute ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule.schema_version"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["2"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["body"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The full Capsule event envelope, as a structured map"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"severity","__idx":11},"children":["Severity"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policy violations carry Capsule's severity. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["severityNumber"]}," maps it onto the OTLP severity ranges, and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["severityText"]}," carries Capsule's own value."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Capsule severity"},"children":["Capsule severity"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"severityNumber"},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["severityNumber"]}]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"OTLP range"},"children":["OTLP range"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["critical"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["21"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["FATAL"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["high"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["17"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["ERROR"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["medium"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["13"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["WARN"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["low"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["9"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["INFO"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule does not rank detections or findings, so those records have no severity fields rather than an invented one."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"body","__idx":12},"children":["Body"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The body is the same envelope the S3 and Splunk destinations receive, with the record under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{ \"schemaVersion\": 2, \"eventType\": \"policy_violation.created\", \"tenantId\": \"...\", \"exportedAt\": \"...\", \"event\": { ... } }\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["It is sent as a structured OTLP value rather than a JSON string, so a backend can query its fields directly. Objects become ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["kvlistValue"]},", arrays become ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arrayValue"]},", integers become ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["intValue"]},", other numbers become ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["doubleValue"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["null"]}," becomes an empty value."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every event carries its anchor resource in full - id, name, type, external id, parent, and the environment and connector it was discovered through - so events correlate against the rest of your inventory without a lookup."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy_violation.created"]}]}," is self-contained: the violation, the policy that raised it including its conditions, and the complete finding, detection and activity records the decision was made on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["detection.created"]}]}," carries the detection, its evidence, and the session activities it was raised on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["finding.created"]}]}," carries the finding, its evidence, and its remediation steps."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Triage state is exported on all three. Secrets Capsule identified in evidence are masked to a short prefix before export, in evidence text and activity message bodies alike."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["One violation, one event."]}," A violation is exported once, when it is first raised. If it is later resolved and the same condition re-triggers, Capsule reuses the existing violation and does not emit a second ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy_violation.created"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"delivery-behaviour","__idx":13},"children":["Delivery behaviour"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Batching"]}," - records are gzipped and split so each request stays under 1 MB compressed, a limit every common OTLP backend accepts."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Oversized events"]}," - a single event that still exceeds the limit after compression is rejected and surfaced on the integration, never truncated. Switching ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Event detail"]}," to Compact is the fix."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Retries"]}," - Capsule retries the statuses the OTLP/HTTP specification marks retryable (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["429"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["502"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["503"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["504"]},"), timeouts, and network errors, with exponential backoff, honouring ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Retry-After"]},". Every other failure is a configuration error and is reported instead."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Timeouts"]}," - each request has 10 seconds to complete."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Visibility"]}," - the outcome of the most recent attempt is shown per integration in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → SIEM"]},", with the full error in the details drawer."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Backfill"]}," - export begins when the integration is enabled. Events raised before that are not sent."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":14},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"rejected-the-credentials-in-the-configured-headers-http-401-or-403","__idx":15},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["rejected the credentials in the configured headers"]}," (HTTP 401 or 403)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The endpoint did not accept the headers. Check the header name your backend expects and the value's format, for example the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Bearer "]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Basic "]}," prefix. Saved values are hidden, so enter every header again and save."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"no-logs-receiver-at-this-url-http-404","__idx":16},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["no logs receiver at this URL"]}," (HTTP 404)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The path is wrong. Give Capsule the collector base URL and let it append ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/logs"]},", or the full logs URL. A base URL that already includes a different signal path, such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/traces"]},", will not work."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"does-not-accept-otlphttp-json-http-415","__idx":17},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["does not accept OTLP/HTTP JSON"]}," (HTTP 415)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The endpoint only accepts protobuf. Capsule sends JSON only. Route the events through an OpenTelemetry Collector, which accepts JSON and exports protobuf or gRPC to the backend."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"accepted-the-request-but-rejected-n-log-records","__idx":18},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["accepted the request but rejected N log record(s)"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The endpoint returned success but reported a partial success, dropping some records. Capsule shows this as a failed delivery with the endpoint's own message, since the dropped records were not stored. The message usually names the limit or field the backend objected to."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"timeouts-or-nothing-arrives","__idx":19},"children":["Timeouts or nothing arrives"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the integration is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["enabled"]}," and at least one event type is turned on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Send test event"]}," - it reports the exact error from the endpoint."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the endpoint is reachable from the internet over ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]}," on the port in the URL. If it sits behind an IP allow-list, Capsule's egress addresses need to be on it. Contact support for the current list."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A request that takes longer than 10 seconds is retried and then reported as failed. Check the endpoint's load and anything between it and the internet, such as a proxy or load balancer."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":20},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration, contact ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"mailto:support@capsule.security"},"children":["support@capsule.security"]},"."]}]},"headings":[{"value":"OpenTelemetry SIEM Integration","id":"opentelemetry-siem-integration","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Prepare your endpoint","id":"step-1-prepare-your-endpoint","depth":2},{"value":"Endpoint URL","id":"endpoint-url","depth":3},{"value":"Headers","id":"headers","depth":3},{"value":"Example: OpenTelemetry Collector","id":"example-opentelemetry-collector","depth":3},{"value":"Step 2: Create the SIEM integration in Capsule","id":"step-2-create-the-siem-integration-in-capsule","depth":2},{"value":"Step 3: Verify","id":"step-3-verify","depth":2},{"value":"What arrives at your endpoint","id":"what-arrives-at-your-endpoint","depth":2},{"value":"Log record mapping","id":"log-record-mapping","depth":3},{"value":"Severity","id":"severity","depth":3},{"value":"Body","id":"body","depth":3},{"value":"Delivery behaviour","id":"delivery-behaviour","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"rejected the credentials in the configured headers (HTTP 401 or 403)","id":"rejected-the-credentials-in-the-configured-headers-http-401-or-403","depth":3},{"value":"no logs receiver at this URL (HTTP 404)","id":"no-logs-receiver-at-this-url-http-404","depth":3},{"value":"does not accept OTLP/HTTP JSON (HTTP 415)","id":"does-not-accept-otlphttp-json-http-415","depth":3},{"value":"accepted the request but rejected N log record(s)","id":"accepted-the-request-but-rejected-n-log-records","depth":3},{"value":"Timeouts or nothing arrives","id":"timeouts-or-nothing-arrives","depth":3},{"value":"Support","id":"support","depth":2}],"frontmatter":{"seo":{"title":"OpenTelemetry SIEM Integration"}},"lastModified":"2026-10-22T19:34:09.343Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/opentelemetry-siem","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}