SIEM decision stream

The decision stream sends each enforcement decision to your SIEM as Thoth records it, so your security team sees agent activity in the tools it already uses. It uses the SIEM destination configured in your workspace settings (siem.provider and siem.webhook): Splunk HEC, Datadog logs, Microsoft Sentinel, Elastic bulk, or a custom HTTPS endpoint that receives a signed JSON body.

What is sent

By default the stream sends holds and blocks (STEP_UP and BLOCK), the decisions a security team triages. You can send every decision instead, and optionally a sample of ALLOWs to keep volume down. Holds and blocks are never sampled.

Each record is one JSON object with the schema thoth.decision/v1:

{
  "schema": "thoth.decision/v1",
  "event_type": "thoth.decision",
  "event_id": "…",
  "occurred_at": "2026-10-24T10:00:00+00:00",
  "tenant_id": "…",
  "decision": "BLOCK",
  "agent": { "id": "billing-agent" },
  "actor": { "user_id": "user_123" },
  "session_id": "…",
  "tool": { "name": "payments.send" },
  "policy": { "reason_code": "delegation_tool_denied", "matched_rule_ids": ["…"] },
  "enforcement_mode": "block",
  "enforcement_trace_id": "…",
  "target_sensitivity": "restricted",
  "acting_privilege": "elevated",
  "evidence": { "event_hash": "…", "chain_index": 42 }
}

Fields appear when Thoth has them: data_classification, risk_score, violation_id, the endpoint and host for proxy traffic, and the signed receipt's ID and signature. Prompts and model output are never sent. Tool arguments are sent only if your data handling setting keeps them, and then in the form it keeps them: hashed by default, redacted, or as sent. With prompts dropped and arguments hashed, the defaults, nothing your agents typed reaches your SIEM.

The record's fields are named so an OCSF mapping can follow without renaming them.

Privilege and sensitivity

A security team's first question is usually whether a privileged identity acted on a sensitive asset. Declare both on the tool, and every record for that tool carries them:

• target_sensitivity: public, internal, confidential or restricted, for what the tool reads or changes.
• acting_privilege: standard, elevated or admin, for the identity (credential) the tool acts with.

resource "thoth_tool_classification" "payments_send" {
  tool_name          = "payments.send"
  classes            = ["write", "external_call"]
  target_sensitivity = "restricted"
  acting_privilege   = "elevated"
}

thothctl tools confirm payments.send --classes write,external_call \
  --target-sensitivity restricted --acting-privilege elevated

An agent's own declaration of a tool takes precedence over the workspace-wide one. The fields are descriptive: they do not change how Thoth decides. A tool without them sends records without them. Changes reach the stream within 30 seconds. The Terraform attributes and thothctl flags ship in the next provider and thothctl releases.

Delivery

Delivery happens as decisions are recorded, separately from enforcement: a slow or unavailable SIEM never delays a decision. Each record is tried up to three times over a few seconds. A redelivered event is not sent twice.

A record that still fails is counted, not queued indefinitely. The settings response shows when a record was last delivered, the last failure and its reason (such as http_503 or timeout), and how many records failed in the last 24 hours, so a gap is visible. Failure records are kept for seven days. A change to the stream or to the destination applies within 30 seconds.

Turning it on

Configure the SIEM destination first; the stream refuses to turn on without one. Changing the stream needs an admin with a recent second factor, and a plan that includes SIEM. A signed-in thothctl session confirms the second factor in the browser; an API key used by Terraform does not need to.

thothctl settings decision-stream set --enabled true
thothctl settings decision-stream get   # setting and delivery health

resource "thoth_siem_decision_stream" "this" {
  decisions = "non_allow" # or "all", with allow_sample_rate for ALLOWs
  depends_on = [thoth_siem_settings.this]
}

The thothctl command and the Terraform resource (thoth.governance.SiemDecisionStream in Pulumi) ship in the next thothctl and provider releases. Destroying the Terraform resource turns the stream off. The API:

GET /{tenant}/thoth/settings/siem/decision-stream
PUT /{tenant}/thoth/settings/siem/decision-stream
Content-Type: application/json
 
{ "enabled": true, "decisions": "non_allow" }

decisions is non_allow (the default) or all. With all, allow_sample_rate (0 to 1, default

1. is the share of ALLOW decisions sent. A field you leave out keeps its current value.