Forward CID222 detections, security events and audit events to a syslog collector or a webhook, as CEF, JSON or OCSF.

CID222 delivers detections and events to your security operations tooling from an outbox poller that runs beside the request path, not inside it. This page covers the collector side of that: what leaves the appliance, in which format, over which transport, and how to prove it arrived.

What do I need?

Licence: Enterprise
Role: admin_user

Prerequisites

A collector that accepts syslog over UDP, TCP or TLS, or an HTTPS endpoint that accepts a JSON batch.
The collector's address and port, reachable from the appliance.
For a TLS collector, a certificate that the appliance's system trust store already accepts.
For a webhook, a shared secret if you want the appliance to sign each batch.
A decision on which of the three streams your SIEM should receive.

What is exported, and what never is

Payloads are metadata only: entity types and counts, the action taken, tenant and session identifiers, scores and verdicts. Never prompt text. Never a response. Never a detected value. A row saying three credit-card numbers were masked carries the type and the number three, and nothing that would let the SIEM become the leak.

Three streams, subscribed independently per destination:

Stream	Source	Contents
Detections	The unified detection feed	Chat, browser and gateway inspection, extension and document detections
Security events	The event log	Blocks, authentication failures, exceptions
Audit events	The event log	Administrative changes and review decisions

Volume: what a destination is actually sent

Every SIEM this product meets is metered, so "forward everything" is a bill, and a bill is how a security control gets switched off. A destination on the current model routes detections by tier:

Tier	What	Delivery
A	Rejections and blocks on any channel, jailbreak and injection, severity 6 and above, and anything that bypassed inspection	Forwarded one for one, immediately
B	Mask and flag volume	One hourly summary per tenant
C	Clean traffic, heartbeats, flags with nothing behind them	Never leaves the appliance

Tier C rows are not discarded — they stay queryable in All Detections. They stop being paid for twice. Security and audit events are already low volume and stay one for one.

Severity ranks residual risk, not effort: content that passed without inspection scores highest, a control failure next, and a block scores low because the exposure did not happen. This is the opposite of the ranking a naive export would produce, and it is why a SOC queue built on it surfaces the events that still matter.

Add a destination

Open the export settings

Select Settings → SIEM Export.

The page lists existing destinations with their health, their volume over the last 24 hours and an estimate of the load they place on your SIEM licence.

Set the dashboard base URL first

Fill in the Dashboard base URL card above the destination list.

Every exported event then carries a link straight back to the record in the dashboard. Leave it empty and the link field is absent from the payload — never empty, never a guess.

Create the destination

Select the action to add a destination, give it a Name, and choose its Destination type:

Syslog (CEF / JSON) — one newline-framed line per event to a collector.
Webhook (JSON batch) — one HTTPS request carrying a batch of events.

Address the collector

Set Host and Port, then Protocol to udp, tcp or tls.

Prefer TLS. UDP silently loses events under pressure and gives the appliance nothing to retry on, which defeats the at-least-once guarantee below.

Choose the format

Set Format:

CEF — syslog only. The most compact, and what most collectors parse without a custom rule.
JSON — one object per event.
OCSF 1.8 — the open schema, for collectors that normalise on it.

OCSF is roughly 3.8 times the size of the same event in CEF. On a per-gigabyte licence that is the multiplier; on a per-event licence nothing changes.

Subscribe the streams

Select the streams this destination receives.

A destination subscribed to nothing delivers nothing. Most deployments send detections and security events to the SIEM and audit events to a separate long-retention destination.

Narrow what it receives

Optionally set a severity floor, an event-type allowlist, and a tenant or group scope.

Every control defaults to permissive. A scope is the control to reach for when one department's events must not reach another department's collector; an unscoped destination sees every department.

Save and test

Save the destination, then use its test action.

The appliance sends one synthetic event through the real transport and the real format. A test that succeeds proves the address, the transport, the certificate and the format together.

Note

A new destination's cursor starts at the moment you create it, so history is not replayed into your SIEM. Widening a scope later does not backfill either.

What a CEF line looks like

A masked detection on the browser channel, wrapped in a syslog header:

CEF:0|CID222|cid-core|0.4.0|PII_DETECTED|content detection: pii|4|rt=1757505451539 externalId=extension:3d3dd9fd-… cat=detections suid=f3de8a7b-… suser=sarah_smith cs1=… cs1Label=sessionId src=10.0.5.42 act=masked channel=browser detection_source=extension kind=prompt direction=request verdict=REDACT detection_group=pii entity_count=3 entity_types=EMAIL,PHONE,PERSON_NAME message_role=user hostname=LT-0142 severity_model=v2 severity_reason=masked tier=A tier_reason=…

Read it as: vendor and product in the header, then the machine signature, the human name and the severity. In the extension, act is the action taken, entity_types are types only, and src is present only where the channel actually recorded an address — an absent key means absent, so a correlation on source address cannot match rows that have none.

The same discipline applies to the device fields: hostname, device_id and device_label appear only on channels that record them, rather than as nulls on every chat event.

Delivery guarantees

At least once. The cursor advances only after a successful send, so a failed delivery is retried on the next cycle. Duplicates are possible; loss is not.
Backoff. After consecutive failures a destination is skipped for an increasing interval, up to fifteen minutes.
Per-destination sequence numbers. Each event carries a sequence number for that destination, so you can reconcile a window by comparing the count you received against the range of numbers.
No cost to the user's request. Measured with all destinations healthy, with one pointed at a closed port, and with export disabled: the largest difference in 95th-percentile request latency across the three states was 1.13 ms against an 11.64 ms threshold. A dead collector is indistinguishable from no collector at all.

Verify

The destination's test event arrives at the collector. Its signature is the synthetic test type and its category is the security-events stream.
Send a prompt containing test personal data through the gateway. Within one poll interval (SIEM_EXPORT_INTERVAL_MS, 30 seconds by default) the collector receives the detection.
The destination row on the settings page shows a recent success time, no error, and a non-zero 24-hour volume.
Wait for a closed hour and confirm the hourly rollup event arrives, carrying that tenant's masked, flagged and blocked counts for the window.
Break the collector deliberately — point the destination at a closed port — and confirm the appliance raises a SIEM_EXPORT_DEGRADED event once the failure count passes SIEM_EXPORT_DEGRADED_AFTER. Restore it and confirm SIEM_EXPORT_RECOVERED.

If it fails

The test succeeds but no detections arrive — the destination subscribes to no stream, or it subscribes only to a stream nothing is writing to. Check the stream selection.
Detections arrive but far fewer than All Detections shows — that is the tiering working. Masks and flags become one hourly summary; clean traffic never leaves the appliance.
The collector rejects the TLS handshake — the appliance validates the collector's certificate against its own system trust store, and there is no field for a private collector authority. A collector using an internal authority needs that authority trusted on the appliance, or the destination's insecure-TLS option enabled, which disables validation entirely.
Events stop after a licence change — the export is gated at run time as well as on the API. A tier downgrade stops it without a restart, and no failure is raised, because nothing failed.
Webhook batches are rejected as unsigned — the shared secret is set on the appliance but your receiver computes the hash over a different body. The signature covers the exact bytes sent.
Every stored webhook secret stopped working after a rotation — secrets are encrypted with a key derived from JWT_SECRET. Rotating that secret invalidates them; re-enter each one.
The volume is far higher than expected on an older destination — it is running the legacy severity model, which forwards every detection one for one and covers the chat channel only. Switching a live destination changes the severity numbers your alert rules match on, so make the change deliberately.

Known gaps

Nothing pushes. The exporter is a poller, so an event reaches the SIEM within one interval rather than instantly.
The repeated-attack escalation is in memory. The window that raises severity for a source attacking repeatedly restarts with the process. It under-escalates rather than over-escalates after a restart.
A destination scope does not replay. Widening a tenant or group scope sends new events only; the events that were filtered out while the scope was narrow are not backfilled.

Next steps

Integrations — the settings page itself, field by field.
ITSM handoff — the other outbound channel: compliance findings sent to a ticket queue.
Diagnostic snapshot — what to collect when the export itself is the thing that is failing.

Export detections to your SIEM