SIEM Integration

Overview

SIEM (Security Information and Event Management) integration forwards Nefia audit logs in real time to external security monitoring platforms. It achieves high throughput through batch processing and asynchronous delivery while ensuring reliability with retry logic.

Supported Forwarders

Configuration

audit:
  siem:
    type: splunk
    endpoint: "https://splunk.example.com:8088/services/collector"
    token_env: "SPLUNK_HEC_TOKEN"
    batch_size: 100
    flush_interval: "5s"
    source: "nefia"
    source_type: "_json"
    index: "security"

{"time": 1709000000, "source": "nefia", "sourcetype": "_json", "index": "security", "event": {...}}

Configuration Options

Delivery Mechanism

Batch Processing

Records are added to a queue asynchronously. A batch is sent when the buffer reaches batch_size or when flush_interval elapses.

Retries

Failed sends are retried with exponential backoff:

• Initial interval: 1 second
• Maximum interval: 30 seconds
• Maximum retries: 3

Network Requirements

• TLS 1.2 or higher
• HTTP timeout: 30 seconds

Security Considerations

• Authentication tokens are passed via environment variables (not written directly in the configuration file)
• Webhooks can verify payload integrity using HMAC-SHA256
• TLS 1.2+ is enforced to ensure secure communication
• Each outgoing payload batch is limited to 1 MB (MaxWebhookPayloadBytes). Batches exceeding this limit are rejected to prevent memory exhaustion

SSRF Prevention

All SIEM endpoint URLs are validated to prevent Server-Side Request Forgery (SSRF) attacks. This protects against an attacker configuring a SIEM endpoint that targets internal services.

URL scheme validation:

• Only https:// and http:// schemes are allowed. Other schemes (e.g., file://, ftp://) are rejected.

DNS resolution validation:

• Hostnames are resolved at configuration time and checked against blocked IP ranges.
• The resolved IP is re-validated at connection time (DialContext) to prevent DNS rebinding attacks where a hostname resolves to a safe address during validation but a private address at connection time.

Blocked address ranges: