Log Receivers and SIEM forwarding

Scrydon forwards the same versioned Audit Log envelope shown in the product and NDJSON export. A Log Receiver includes audit, workflow, and integrity events by default, so downstream systems do not need separate integrations or joins.

Configure a receiver

Open Settings → Platform → Audit Log → Log Receivers, then create a receiver with:

• a name;
• an HTTPS webhook URL on a public address, or on a private network your Scrydon operator opened to your organization;
• an optional filter by event type, action, resource type, actor, producer, or time range.

The URL must be https:// and must resolve only to public addresses. Private, loopback, link-local and cloud-metadata addresses — and names such as localhost — are refused when the receiver is saved (Log Receiver URL must be a public https address) and again at every delivery, after DNS resolution. Deliveries do not follow redirects: point the receiver at the final collector URL.

A collector on a private network

A SIEM collector that is reachable only on your own network — common on premises, in air-gapped installs, and behind a cloud private endpoint — needs the operator who installed Scrydon to open that network with the Helm value global.egress.privateNetworks: its address ranges, its ports, your organization, and optionally the internal certificate authority that signs the collector's certificate. Nothing in Settings opens a private network. Once it is open, save the receiver with the collector's URL as usual: the same check runs when you save it and on every delivery, so a URL the operator allowed is never refused at save. Addresses outside the network — and loopback, link-local and cloud-metadata addresses, whatever the network — stay refused, and the refusal says an operator can allow a private network with global.egress.privateNetworks.

Scrydon displays the HMAC secret once. Store it in your SIEM/collector secret store. Multiple receivers can be active at the same time—for example, all events to a data lake and integrity events to an incident-response SIEM.

Verify a delivery

Each request includes:

• X-Scrydon-Timestamp: <unix-ms>;
• X-Scrydon-Signature: v1=<hex HMAC-SHA256>.

Compute HMAC-SHA256 over {timestamp}.{rawBody} using the receiver secret and compare it in constant time. Reject timestamps more than five minutes from the collector's clock before parsing the body.

Delivery behavior

• At least once: deduplicate on the envelope id.
• Durable retries: failed deliveries retry over approximately 34 hours.
• Dead letters: after the retry budget, the delivery remains visible and can be replayed from the receiver row.
• Independent ingestion: a slow or unavailable destination does not block Audit Log appends.

Use the receiver's test action after creation or secret rotation. The receiver health row shows the latest success and failure details.

Telemetry windows

When your installation runs the high-volume telemetry store, its events — resource reads and API calls — are not in the per-row chain; they are proven by signed 10-second attestation windows. A receiver forwards them only when Also forward telemetry is on (off by default; the tab asks you to confirm because it can multiply what the receiver gets).

With it on, each attested window becomes one extra delivery:

• Content-Type: application/x-ndjson — one schemaVersion: 3 envelope per line, oldest first, ending with a newline. Governance deliveries stay single application/json envelopes.
• Signed with the same headers over the same {timestamp}.{rawBody} string.
• The receiver's filter is applied to each line. A window with no matching line sends nothing.
• A window is sent only once every attested row can be read back; until then the delivery retries on the normal schedule.
• Deduplicate each line on its id, as for any delivery. proof.batchId names the window, which Verify attestation window in the evidence view checks.

Envelope and filtering

Every request uses the common envelope documented under Audit Log. Filters operate on its stable fields: type, action, resource.type, actor, producer, and timestamps. Protected rows use the same clearance-aware redaction rules as list and export.

Related

• Audit Log — envelope, integrity, and retention.
• Audit Log catalogue — accepted event values.
• Observability — application logs, metrics, and traces, which are separate from retained Audit Log evidence.