Broadcast the audit trail to your SIEM

01In a nutshell #sec_b2947bf1

BEACON delivers the audit trail in order, by chain, signed, to your SIEM or your storage — and a retention cut arrives as a signed cut, never as a hole.

02Where #sec_5f11263a

Settings › Integrations & AI › BEACON. Broadcasting is included in the Unlimited edition; elsewhere, on request, at the discretion of the publisher. The screen tells you if this is your case.

Two paths coexist, and the screen presents them together: the push — what this page configures — and the verifiable pull: your SIEM can also read the trail itself, chain by chain, with the same links and manifests as the push. The pull goes through an API client with the audit reading scope.

03Before creating: fresh identity #sec_018aa8e8

Creating a destination is a sensitive act: the entire audit trail of the subscription will go to a third party. The screen therefore requires strong authentication of less than ten minutes — Confirm your identity. You will be redirected to your directory, then brought back here. If this fails, the cause is almost always in the assurance settings of your identity provider.

04New destination #sec_69919eb6

The wizard proceeds step by step.

Name and transport. Known transports each carry their own expectation, written on the URL field: a Splunk collector (https://host:port, or the URL ending with /services/collector), an Elastic flow (the complete _bulk URL of a data flow or index), a Sentinel collection rule (the complete ingestion URL of a collection rule), or an object storage bucket.

The target's identifiers. They differ by transport, and the wizard says each time what it keeps and what it doesn't keep:

• Sentinel: the directory identifier and the application identifier — *these are not

secrets — then the certificate with its private key. The file and password only live for the duration of this gesture: the key is sealed, never kept in plain text.*

• Object storage: the bucket owner account — *each write requires it: a

bucket name reused by a third party will refuse the trail — and an access key. Only grant the right to write to the beacon/ prefix of this bucket. Keys are tested by a probe write before being retained.*

The geography. The wizard observes where the target lives and compares it to the hosting of your subscription. If the events are going to leave it, a justification is required: the events will leave the geography of the subscription: this acknowledgment is traced in the audit trail.

The start. From the beginning of each chain (complete history), or from activation (only what follows). For a SIEM that must be able to verify, take the history.

The filter. Optional: an action code per line, or a prefix ending with a dot and a star — empty = complete flow. Read the warning before setting one: a filter replaces discarded events with milestones: the sealed proof stops at the first milestone; beyond, the verifier only checks the chaining. A filter buys less volume for less proof.

Create. For Sentinel, the destination is born as a draft: activate it from its panel once the role is granted on the collection rule. For the others, Activate upon creation is proposed.

05Read the list #sec_75146433

Each destination carries its target, its status — Active, Paused after failures, Manual pause, Deactivated, Draft —, its delay (Up to date, or N min, N h, N d) and its margin before cut: N% remaining.

The margin is the number to watch. The subscription's retention eventually cuts the oldest events; a destination delayed by more than this margin will receive a signed cut where it was waiting for events. Never a hole, but a proven lack. A destination paused after failures that ages approaches this point.

06What the SIEM receives #sec_28ee06bd

Events delivered in order, by chain, signed, with the manifests that allow verifying the chaining outside of REVIEWIT. The BEACON page of the Concepts describes the format, and the public verification tool what it controls. On the workspace side, the audit posture displays the active destinations: these destinations receive the entire audit trail of the subscription, this workspace included.

07The rhythm #sec_8b53d5d6

08To remember #sec_448d6cb0

A fresh identity, a transport, proven then sealed identifiers, an assumed geography. The complete flow is the only configuration that keeps the entire proof; a filter says it, a delay is read, a cut is signed.