PHP code example of cboxdk / laravel-siem

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

cboxdk / laravel-siem example snippets

use Cbox\LaravelSiem\Contracts\{LogStreams, StreamDispatcher};
use Cbox\LaravelSiem\Enums\Destination;
use Cbox\Siem\ValueObjects\SiemEvent;

// 1. Register a destination (endpoint SSRF-checked; secret encrypted, revealed once).
app(LogStreams::class)->create(
    name: 'splunk-prod',
    destination: Destination::SplunkHec,
    endpointUrl: 'https://http-inputs.example.splunkcloud.com',
    secret: 'your-hec-token',
    redaction: ['password' => 'drop', 'email' => 'hash'],
);

// 2. In your own DB transaction, write the event to the outbox (a cheap insert).
DB::transaction(function () use ($event) {
    // ... your business write ...
    app(StreamDispatcher::class)->dispatch($event, app(LogStreams::class)->enabled());
});

// 3. The queued pump batches, redacts, formats, and ships it — off the request thread.

app(LogStreams::class)->create(
    name: 'datadog',
    destination: Destination::Datadog,
    endpointUrl: '',                     // derived: https://http-intake.logs.<site>/api/v2/logs
    secret: 'your-datadog-api-key',
    options: [
        'site' => 'datadoghq.eu',
        'service' => 'my-app',           // default: app.name
        'source' => 'cbox',              // ddsource, default: siem.datadog.source
        'tags' => ['env:prod', 'team:security'],
        // 'hostname' => 'id.example.com',  default: the host of app.url
    ],
);

$registered = app(LogStreams::class)->create(
    name: 's3-archive',
    destination: Destination::S3,
    endpointUrl: '',                     // AWS: derived from the region
    secret: 'secret-access-key',         // omit for an assumed role
    options: [
        'bucket' => 'acme-audit-logs',
        'region' => 'eu-west-1',
        'prefix' => 'cbox/audit',
        'access_key_id' => 'AKIA…',      // or: 'role_arn' => 'arn:aws:iam::123456789012:role/siem-writer'
        'sse' => 'aws:kms',              // optional: AES256 | aws:kms
        'kms_key_id' => 'alias/audit',   // optional, with aws:kms
    ],
);

$registered->stream->destinationOptions()['external_id'] ?? null; // show this for the trust policy

app(LogStreams::class)->create(
    name: 'gcs-archive',
    destination: Destination::Gcs,
    endpointUrl: '',                     // https://storage.googleapis.com
    secret: file_get_contents('siem-writer-key.json'),
    options: ['bucket' => 'acme-audit-logs', 'prefix' => 'cbox/audit'],
);

bash
composer  vendor:publish --tag="siem-migrations"
php artisan vendor:publish --tag="siem-config"   # optional
php artisan migrate