# SIEM decision stream

> Send Thoth's enforcement decisions to Splunk, Datadog, Sentinel, Elastic or a signed webhook as they happen.

Source: https://docs.atensecurity.com/docs/operations/siem-decision-stream

The decision stream sends each enforcement decision to your SIEM as Thoth records it, so your
security team sees agent activity in the tools it already uses. It uses the SIEM destination
configured in your workspace settings (`siem.provider` and `siem.webhook`): Splunk HEC, Datadog
logs, Microsoft Sentinel, Elastic bulk, or a custom HTTPS endpoint that receives a signed JSON
body.

## What is sent

By default the stream sends **holds and blocks** (`STEP_UP` and `BLOCK`), the decisions a security
team triages. You can send every decision instead, and optionally a sample of `ALLOW`s to keep
volume down. Holds and blocks are never sampled.

Each record is one JSON object with the schema `thoth.decision/v1`:

```json
{
  "schema": "thoth.decision/v1",
  "event_type": "thoth.decision",
  "event_id": "…",
  "occurred_at": "2026-10-24T10:00:00+00:00",
  "tenant_id": "…",
  "decision": "BLOCK",
  "agent": { "id": "billing-agent" },
  "actor": { "user_id": "user_123" },
  "session_id": "…",
  "tool": { "name": "payments.send" },
  "policy": { "reason_code": "delegation_tool_denied", "matched_rule_ids": ["…"] },
  "enforcement_mode": "block",
  "enforcement_trace_id": "…",
  "target_sensitivity": "restricted",
  "acting_privilege": "elevated",
  "evidence": { "event_hash": "…", "chain_index": 42 }
}
```

Fields appear when Thoth has them: `data_classification`, `risk_score`, `violation_id`, the
endpoint and host for proxy traffic, and the signed receipt's ID and signature. Prompts and model
output are never sent. Tool arguments are sent only if your
[data handling](https://docs.atensecurity.com/docs/operations/data-handling) setting keeps them, and then in the form it keeps
them: hashed by default, redacted, or as sent. With prompts dropped and arguments hashed, the
defaults, nothing your agents typed reaches your SIEM.

The record's fields are named so an OCSF mapping can follow without renaming them.

### Privilege and sensitivity

A security team's first question is usually whether a privileged identity acted on a sensitive
asset. Declare both on the tool, and every record for that tool carries them:

- `target_sensitivity`: `public`, `internal`, `confidential` or `restricted`, for what the tool
  reads or changes.
- `acting_privilege`: `standard`, `elevated` or `admin`, for the identity (credential) the tool acts
  with.

```terraform
resource "thoth_tool_classification" "payments_send" {
  tool_name          = "payments.send"
  classes            = ["write", "external_call"]
  target_sensitivity = "restricted"
  acting_privilege   = "elevated"
}
```

```bash
thothctl tools confirm payments.send --classes write,external_call \
  --target-sensitivity restricted --acting-privilege elevated
```

An agent's own declaration of a tool takes precedence over the workspace-wide one. The fields are
descriptive: they do not change how Thoth decides. A tool without them sends records without them.
Changes reach the stream within 30 seconds. The Terraform attributes and `thothctl` flags ship in
the next provider and thothctl releases.

## Delivery

Delivery happens as decisions are recorded, separately from enforcement: a slow or unavailable
SIEM never delays a decision. Each record is tried up to three times over a few seconds. A
redelivered event is not sent twice.

A record that still fails is counted, not queued indefinitely. The settings response shows when a
record was last delivered, the last failure and its reason (such as `http_503` or `timeout`), and
how many records failed in the last 24 hours, so a gap is visible. Failure records are kept for
seven days. A change to the stream or to the destination applies within 30 seconds.

## Turning it on

Configure the SIEM destination first; the stream refuses to turn on without one. Changing the
stream needs an admin with a recent second factor, and a plan that includes SIEM. A signed-in
`thothctl` session confirms the second factor in the browser; an API key used by Terraform does
not need to.

```bash
thothctl settings decision-stream set --enabled true
thothctl settings decision-stream get   # setting and delivery health
```

```terraform
resource "thoth_siem_decision_stream" "this" {
  decisions = "non_allow" # or "all", with allow_sample_rate for ALLOWs
  depends_on = [thoth_siem_settings.this]
}
```

The `thothctl` command and the Terraform resource (`thoth.governance.SiemDecisionStream` in
Pulumi) ship in the next thothctl and provider releases. Destroying the Terraform resource turns
the stream off. The API:

```http
GET /{tenant}/thoth/settings/siem/decision-stream
PUT /{tenant}/thoth/settings/siem/decision-stream
Content-Type: application/json

{ "enabled": true, "decisions": "non_allow" }
```

`decisions` is `non_allow` (the default) or `all`. With `all`, `allow_sample_rate` (0 to 1, default
1) is the share of `ALLOW` decisions sent. A field you leave out keeps its current value.