Primust Dashboard

Supported SIEMs

Selected events

Registered connectors

Raw to Primust

Never

Destination

Connector nameIdentity strategySeverity floor

Splunk fields

HEC URL *HEC token *IndexSourcetype

Paste target: Settings > Data Inputs > HTTP Event Collector. Source feeds: search, hec.

Event filters

session lifecyclellm prompt commitmentllm model bindingllm cost boundsllm response receipttool executionpermission decisionprompt injection signaltool schema driftscope consumption violationmcp call completionoutbound action evidencecoverage gap recordingcredential issuance

Include deployment posture observationsInclude direct customer-to-SIEM raw payload fields

Generated JSON

Local preview is deterministic. The server generator button uses `/api/v1/siem-connectors/generate-config` when that endpoint is available.

{
  "schema_version": "primust.siem.integration.v1",
  "display_name": "Production SOC export",
  "siem_type": "splunk",
  "paste_target": "Settings > Data Inputs > HTTP Event Collector",
  "destination": {
    "console_target": "Splunk HEC input",
    "source_feeds": [
      "search",
      "hec"
    ]
  },
  "vendor": {
    "hec": {
      "url": "{{HEC_URL}}",
      "token": "{{HEC_TOKEN_SECRET_REF}}",
      "index": "primust",
      "sourcetype": "_json",
      "source": "primust:runtime"
    }
  },
  "filters": {
    "event_categories": [
      "session_lifecycle",
      "llm_prompt_commitment",
      "llm_model_binding",
      "llm_cost_bounds",
      "llm_response_receipt",
      "tool_execution",
      "permission_decision",
      "prompt_injection_signal",
      "tool_schema_drift",
      "scope_consumption_violation",
      "mcp_call_completion",
      "outbound_action_evidence",
      "coverage_gap_recording",
      "credential_issuance"
    ],
    "severity_floor": "info",
    "include_posture_observations": true,
    "include_direct_siem_raw_content": false,
    "raw_content_boundary": "commitments and bounded metadata only"
  },
  "identity": {
    "strategy": "actor_principal",
    "correlation_fields": [
      "user.email_hash",
      "user.account_uuid",
      "organization.id",
      "session.id",
      "run_id",
      "system_id",
      "agent_ref",
      "surface_id"
    ]
  },
  "primust": {
    "connector_registration_endpoint": "/api/v1/siem-connectors",
    "event_schema": "https://docs.primust.com/event-schema",
    "supported_siem_types": [
      "splunk",
      "sentinel",
      "datadog",
      "generic_webhook"
    ]
  }
}

Connector settings Delivery health

No SIEM connector is registered yet.

Copy the generated config for SIEM admin setup, or register the connector when the required credential fields are present.

API

Headless capture and output wiring paths.

GET /siem-connectorsPOST /siem-connectorsPOST /siem-connectors/{connector_id}/testPOST /siem-connectors/generate-config