Skip to main content

EventBridge

EventBridge is the local interface into a running Synapse agent. Your own software can subscribe to what the agent is seeing, or ask it a direct question about one connection and get an answer back.

That closes a gap nothing else does. Your application knows the socket it is serving. It does not know the client's TLS fingerprint, its SNI, or how its TCP stack behaved — the agent does, and this is how you get it without implementing any capture yourself.

Two interfaces​

What it isReach for it when
Event streamEvents pushed as they happen — HTTP requests and packets, with their fingerprintsYou want a live feed to consume or display
Control socketA request/response query about a specific connectionYou have a connection in hand and want to know what the agent saw

Both are local sockets on the host — a Unix domain socket on Linux and macOS, a loopback address on Windows. Neither is exposed to the network, so the interface is available to processes on the box and to nothing else.

Asking about a connection​

You identify a connection by its source address, optionally narrowing with source port, destination address and port, or a fingerprint you already hold. The agent answers from its cache of recent connections.

What comes back is everything it captured for that connection:

TLSJA4 and JA4S, plus the raw JA4 string
TCPJA4T and JA4TS, with the hash form
LatencyJA4L and JA4LS
HTTPJA4H
CertificateJA4X
Handshake detailSNI, ALPN, and the negotiated TLS version
ContextThe connection four-tuple and when it was captured

You can ask for a summary or the full event detail.

The SNI and ALPN are worth calling out. Your application sees the request; it does not see what hostname the client asked for at the TLS layer, or what protocol it offered. Those are frequently the interesting part of a mismatch.

What you can build with it​

  • Enrich a request in your own handler — look up the connection you are serving and attach the client's fingerprint to your own logs or risk scoring.
  • Step up authentication on an unfamiliar client by treating the fingerprint as one factor.
  • Confirm during an incident that the connection you are looking at is the one you think it is, rather than inferring from timestamps.
  • Build your own view on the event stream — the terminal client that ships with Synapse is itself a consumer of this interface.

Limits worth knowing​

  • The cache is bounded and recent. A connection old enough to have been evicted returns nothing. This is a live interface, not a history — for anything retrospective use Security Event Export.
  • Local only, by design. There is no network listener to secure, and equally no remote access; anything off-host has to go through the export path instead.
  • Answers are best-effort. Fields are absent rather than wrong when a view was never captured — a connection that never completed a TLS handshake has no JA4, and says so by omitting it.

See also​