Skip to main content
Log shipping gets your organisation’s audit events out of Ainomos and into your SIEM, so your security team can search, correlate and keep them with the rest of your logs. Ainomos can send events to Splunk itself (push), or your SIEM can fetch them (pull). Either way, each event carries metadata only. The content of questions and documents stays in Ainomos. Who can do this: platform admins. Every change to a destination, a reader, a certificate authority or a pinned certificate asks for a reason and is recorded as evidence.

What is sent

Each event is one governed run with its evidence record, or one app read. For what those are, see the audit log. Sent: who, when, which room, what kind of event, the outcome, the identifiers of governance acts, whether the evidence record is signed, and a link to it in Ainomos. Never sent: questions, answers, reasons, decision titles and document text. Technical logs of the application, the model gateway or sign-in are not shipped either. Events arrive one to two minutes after they happen.

Event classes

You can limit a destination, or a fetch, to some classes:

Formats

Choose the format per destination, or with each fetch.
The default. One flat object per event:

Send to Splunk (push)

About every minute, Ainomos sends new events to Splunk’s HTTP Event Collector. It moves on only after Splunk accepts a batch, so nothing is lost while Splunk is down. A retry can repeat events. In a search, remove repeats with dedup event_id.
1

Prepare Splunk

In Splunk, create an HTTP Event Collector token and choose an index.
2

Add a destination

Open Settings, then Log shipping. Fill in New Splunk destination (see the fields below) and click Save as draft. Enter a reason when asked. A new destination does not send anything yet.
3

Test it

Click Send test event. Ainomos sends one event marked as a test. The page says “Splunk accepted the test event”, or why Splunk refused it or could not be reached.
4

Activate it

Click Activate and enter a reason. Delivery starts from the Start you chose.

Keep an eye on delivery

Each destination shows a badge: Up to date, Behind by more than 15 minutes, Behind by more than an hour, Delivery failing or Inactive. It also shows the Delivered events, how many are Waiting, the Last delivery and the Last error. System status checks each destination too. The buttons on a destination:

Certificates

Ainomos sends only over HTTPS to a certificate it trusts. It refuses private network addresses unless the operator of your installation allowed the host, and it does not follow redirects. If your Splunk uses a certificate from your company’s certificate authority, click Add company CA and paste or load the CA certificate (PEM). Ainomos trusts it for this destination only, in addition to the public authorities, and still checks the host name, so renewed certificates keep working. If the test fails because Ainomos does not trust the certificate, the page shows its SHA-256 fingerprint. Compare it with the one your Splunk administrator sees on the server. If they match, click Trust this certificate. Ainomos then accepts exactly this certificate for this destination. A renewed certificate has to be trusted again.

Let your SIEM fetch events (pull)

Your SIEM can also fetch events itself with its own reader client. Create one reader per consumer, so you can revoke each on its own.
1

Create a reader

Under API access (pull), enter a Reader name, click Create reader client and give a reason.
2

Copy the secret

The page shows the client ID, the client secret and a ready-made command to get a token. Copy the secret now. It is shown only once and is not stored in Ainomos.
3

Fetch events

Your SIEM gets a token with the client credentials grant and calls the events address shown under Request example. In Splunk, a REST API modular input can poll it.
Each request can ask for up to 1000 events (limit), some classes (class), and a format (format, json or ocsf). The answer contains next_cursor: pass it back as cursor on the next request to continue where you stopped. On the first request, since skips older history. Every request that returns events writes its own audit record. Click Revoke to block a reader at once.

On your own infrastructure

Log shipping runs inside your installation and needs no cloud service. Your operator can trust one company CA for every destination and can open a Splunk at a private address to Ainomos. If the cluster blocks outgoing traffic, the operator allows the Splunk host and port, usually 8088.