gitea-admin/gh-christianlouis-dmarq
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add SIEM integration templates

Browse Source
This commit is contained in:
Christian Krakau-Louis
2026-05-23 18:26:50 +02:00
parent 946925d370
commit c1b53cf81f
9 changed files with 707 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/milestones.md
+2 -1
View File
@@ -237,7 +237,8 @@ Goal: let DMARQ integrate cleanly into existing security and operations workflow
Planned:
- A stable, documented read-only API surface for posture and reporting queries. Delivered with scoped `reports:read`, `posture:read`, and `tls-reports:read` API tokens, public read-only endpoints, and per-token usage audit fields.
- Webhook event delivery for key events (new sender source, compliance drop, missing reports, alert lifecycle). Delivered with encrypted webhook endpoints, signed delivery headers, idempotency keys, retry/backoff state, test sends, and delivery inspection.
- Integration templates for SIEM and ticketing workflows (export formats, payload schemas, examples).
- SIEM integration templates delivered with a stable `dmarq.siem.event.v1` schema, source/compliance/alert examples, Splunk HEC, Elastic ECS, and Microsoft Sentinel ingestion shapes, and sensitive-field redaction guidance.
- Ticketing/chatops integration templates (Jira, GitHub, Slack, Teams).
- Token/scoping model for API access that matches governance needs (service accounts, least privilege).
Exit criteria: