SIEM Integration and Event Streaming - Use Cases

See It In Action

Watch Events Flow to Every Destination

One event bus. Six SIEMs. Zero missed alerts.

corelink-events

$ corelink events stream --format json

[event] secret.rotated -> Splunk HEC (200 OK, 12ms)

[event] secret.rotated -> Sentinel (202 Accepted, 45ms)

[event] nhi.connected -> Kafka topic:security-events (ack, 3ms)

[event] break_glass.unsealed -> Webhook https://pagerduty.com/... (200 OK, 89ms)

[event] break_glass.unsealed -> Splunk HEC (200 OK, 8ms) [CRITICAL]

[event] audit.critical -> All subscribers (6 delivered, 0 failed)

[stats] 1,247 events/min | 99.97% delivery rate | p99: 52ms

Three steps. Real-time delivery.

Configure your targets once. Every security event reaches every destination automatically.

Configure SIEM Targets

Add your Splunk HEC endpoint, Sentinel workspace, Datadog API key, or any of the other 3 native integrations. Kafka, SQS, and webhook targets are also supported.

Subscribe to Event Topics

Choose which event topics each destination receives -- secrets rotation, NHI connections, break-glass events, audit criticals, or everything. Fine-grained per-destination filtering.

Real-Time Delivery

Events are delivered in real time with automatic retries, circuit breakers, and dead-letter queuing. Critical events like break-glass unseals are prioritized and delivered first.

Every SIEM, every pipeline

Six native SIEM integrations, three streaming protocols, and webhook delivery with HMAC signing.

Native

Six SIEM Integrations

Native connectors for Splunk HEC, Microsoft Sentinel, Datadog Logs, Elastic SIEM, IBM QRadar, and Sumo Logic. Each uses the platform's native ingest API -- no agents, no forwarders required.

Splunk HEC Sentinel Datadog Elastic QRadar Sumo Logic

Streaming

Kafka, SQS, and SSE

Publish events to Kafka topics, AWS SQS queues, or Server-Sent Event streams for browser-based consumers. All three support per-topic routing and priority ordering.

Kafka topics AWS SQS SSE streams Topic routing

HMAC-SHA256

Webhooks with HMAC Signing

Every webhook delivery is signed with HMAC-SHA256. Receivers can verify the signature to confirm the payload originated from CoreLink and was not tampered with in transit.

HMAC-SHA256 Retry logic Dead-letter queue

Reliability

Circuit Breakers and Priority

Circuit breakers prevent cascade failures when a destination is unavailable. Critical events (break-glass, audit failures) are queued with higher priority and retried independently of routine events.

Circuit breakers Priority queues Event enrichment

Events Reach Your SIEM Before Action Is Taken

Critical security events like break-glass unseals are delivered to all configured SIEM destinations before the requesting user can take any action. Alerting is not an afterthought -- it is part of the enforcement flow.

All event payloads include enriched context: tenant ID, workspace, actor identity, resource affected, and the full hash-chained audit reference. Your SIEM receives everything it needs to correlate and respond -- no separate log shipping required.

Security Event

Event Bus

All SIEMs

Real-Time Security Events to Every SIEM Platform