Security Event Export
Synapse decides things at several layers — a packet dropped in the kernel, a request blocked by the WAF, a source flagged by threat intelligence, an IDS signature matched. Each of those is a security event, and each is emitted through one unified stream.
That matters because the alternative is correlating seven log formats to answer "why was this client blocked?".
One event model, whatever decided
Every layer that makes a decision emits the same structured event:
| Layer | Decides |
|---|---|
| Access rules | Address blocked in the kernel |
| Smart firewall | Fingerprint-driven kernel block |
| IDS | Signature matched |
| WAF | HTTP request blocked or challenged |
| Threat intel | Source reputation acted on |
| CAPTCHA | Challenge issued or passed |
| Rate limit | Client throttled |
Each event carries the layer that decided and the action taken, so a single query answers "everything we blocked, and why" without joining across sources.
Where it can go
| Destination | Format | Reach for it when |
|---|---|---|
| Local event log | Human-readable lines | You are on the box, tailing |
| JSON Lines file | One self-contained record per line | A shipper — Fluent Bit, Vector, an OTel Collector filelog receiver — is already running |
| OTLP over HTTP | Batched OpenTelemetry log records | You have a collector and want push, not scrape |
| CEF | ArcSight Common Event Format | Your SIEM is ArcSight, QRadar, or anything that ingests CEF natively |
| syslog | Standard syslog, with facility and identifier | Central syslog is the collection point |
On Windows, events can additionally go to ETW and the Windows Event Log.
CEF carries three streams, not just one: security decisions, IDS alerts, and access logs — so a SIEM gets the whole picture in the format it already parses, rather than a decision feed it has to reconcile with logs from elsewhere.
Why both a readable log and a structured one
They serve different readers, and neither substitutes for the other.
The readable log is for a person debugging at 3am who wants to see what just happened. The structured stream is for machines — stable field names, one record per line, no parsing heuristics. Both are fed from the same event, so they cannot disagree about what occurred.
Limits worth knowing
- Export is push or file, not a query API. Synapse emits; it does not store a searchable history. Retention and search are your collector's job.
- OTLP batches. Events arrive at the collector in batches rather than one at a time, so there is a small delay between decision and visibility.
- A shipper is still your responsibility. The JSON Lines sink writes a file; something has to move it.
Use cases
- Answer "why was this blocked?" from one query, instead of correlating kernel, proxy and IDS logs by timestamp.
- Feed an existing SIEM without a translation layer, by emitting CEF it already understands.
- Alert on the decision rate — a sudden spike in blocks is a signal in its own right.
- Keep an audit trail of enforcement actions, with the layer and reason attached to each.
See also
- Axiom and Honeycomb — worked examples for specific backends
- Configuration — sinks, paths, endpoints and levels
- Threat Detection — where the reputation half of these events comes from
- WAF — where the HTTP half comes from