> ## Documentation Index > Fetch the complete documentation index at: https://docs.ainomos.ch/llms.txt > Use this file to discover all available pages before exploring further. # Log shipping > Send your organisation's audit events to Splunk, or let your SIEM fetch them, as Ainomos JSON or OCSF. **Log shipping** gets your organisation's audit events out of Ainomos and into your SIEM, so your security team can search, correlate and keep them with the rest of your logs. Ainomos can send events to Splunk itself (push), or your SIEM can fetch them (pull). Either way, each event carries metadata only. The content of questions and documents stays in Ainomos. Who can do this: platform admins. Every change to a destination, a reader, a certificate authority or a pinned certificate asks for a reason and is recorded as evidence. ## What is sent Each event is one governed run with its evidence record, or one app read. For what those are, see the [audit log](https://docs.ainomos.ch/privacy/audit-log.md). **Sent**: who, when, which room, what kind of event, the outcome, the identifiers of governance acts, whether the evidence record is signed, and a link to it in Ainomos. **Never sent**: questions, answers, reasons, decision titles and document text. Technical logs of the application, the model gateway or sign-in are not shipped either. Events arrive one to two minutes after they happen. ### Event classes You can limit a destination, or a fetch, to some classes: | Class | Covers | | - | - | | **chat** | Chat answers. | | **agent** | Agents acting, their tool calls and validations. | | **import** | Content coming in and its review. | | **decision** | Proposing, deciding, revising and ending decision records and relations. | | **governance** | Rooms, memberships, responsibilities, rules, exceptions, users and agent access. | | **platform** | Organisation-wide settings: models, privacy settings, sign-in, content language, file storage, mail, alerts, maintenance, log shipping and resets. | | **read** | App reads. | | **other** | Anything else. | ## Formats Choose the format per destination, or with each fetch. > [tab] Ainomos JSON > > The default. One flat object per event: > > | Field | Content | > | - | - | > | `event_id` | A unique ID. Use it to remove repeats. | > | `record_source` | `evidence_bundle` or `resource_read`. | > | `class` | The event class, see above. | > | `kind` | The recorded kind of event, for example `chat`. | > | `occurred_at` | When it happened, in UTC. | > | `tenant` | Your organisation. | > | `room_slug`, `room_name` | The room. | > | `actor` | The user or principal. | > | `agent` | The agent or app client, if any. | > | `outcome` | For example `ok`, `blocked`, `error` or `read`. | > | `acts` | The governance acts, each with `act`, `subject_type` and `subject_id`. | > | `subject` | For an app read, the resource that was read. | > | `run_id` | The ID of the run behind the evidence record. | > | `signed` | Whether the evidence record is signed. | > | `evidence_url` | The address of the evidence record in Ainomos. Only a platform admin can open it. | > [tab] OCSF > > Each event maps to OCSF 1.9.0, class API Activity (6003). The actor, the app, the room, the outcome and the event ID go to their OCSF fields. Fields without an OCSF counterpart, such as `class`, `kind`, `record_source`, `acts`, `signed` and `evidence_url`, go under `unmapped`. ## Send to Splunk (push) About every minute, Ainomos sends new events to Splunk's HTTP Event Collector. It moves on only after Splunk accepts a batch, so nothing is lost while Splunk is down. A retry can repeat events. In a search, remove repeats with `dedup event_id`. **1. Prepare Splunk** In Splunk, create an HTTP Event Collector token and choose an index. **2. Add a destination** Open **Settings**, then **Log shipping**. Fill in **New Splunk destination** (see the fields below) and click **Save as draft**. Enter a reason when asked. A new destination does not send anything yet. **3. Test it** Click **Send test event**. Ainomos sends one event marked as a test. The page says "Splunk accepted the test event", or why Splunk refused it or could not be reached. **4. Activate it** Click **Activate** and enter a reason. Delivery starts from the **Start** you chose. | Field | What to enter | | - | - | | **Name** | A name you recognise. | | **HEC URL** | The address of the HTTP Event Collector. It must use HTTPS. | | **HEC token** | The token from Splunk. It is stored encrypted and never shown again, only its last four characters. When editing, leave it empty to keep the stored token. | | **Index (optional)** | The Splunk index. Empty uses the token's default. | | **Source type** | Set to `ainomos:audit`. Change it only if your Splunk expects another. | | **Source (optional)** | A Splunk source value, if you want one. | | **Format** | **Ainomos JSON** or **OCSF 1.9.0 API Activity**. | | **Event classes** | Tick the classes to send. Tick none to send every class. | | **Start** | `now` to send only new events, or a date such as 2026-09-01 to send older events too. | ### Keep an eye on delivery Each destination shows a badge: **Up to date**, **Behind by more than 15 minutes**, **Behind by more than an hour**, **Delivery failing** or **Inactive**. It also shows the **Delivered events**, how many are **Waiting**, the **Last delivery** and the **Last error**. [System status](https://docs.ainomos.ch/admin/system-status.md) checks each destination too. The buttons on a destination: | Button | What it does | | - | - | | **Disable** | Stops sending. Events wait until you activate it again. | | **Edit** | Changes the fields. An edited destination becomes inactive until you test and activate it again. A new address also drops a pinned certificate. | | **Rotate token** | Replaces the stored HEC token. | | **Add company CA** | Trusts your company's certificate authority for this destination. Once added, **Remove company CA** takes it away. | | **Remove pinned certificate** | Shown when a certificate is pinned. | ### Certificates Ainomos sends only over HTTPS to a certificate it trusts. It refuses private network addresses unless the operator of your installation allowed the host, and it does not follow redirects. If your Splunk uses a certificate from your company's certificate authority, click **Add company CA** and paste or load the CA certificate (PEM). Ainomos trusts it for this destination only, in addition to the public authorities, and still checks the host name, so renewed certificates keep working. If the test fails because Ainomos does not trust the certificate, the page shows its SHA-256 fingerprint. Compare it with the one your Splunk administrator sees on the server. If they match, click **Trust this certificate**. Ainomos then accepts exactly this certificate for this destination. A renewed certificate has to be trusted again. ## Let your SIEM fetch events (pull) Your SIEM can also fetch events itself with its own reader client. Create one reader per consumer, so you can revoke each on its own. **1. Create a reader** Under **API access (pull)**, enter a **Reader name**, click **Create reader client** and give a reason. **2. Copy the secret** The page shows the client ID, the client secret and a ready-made command to get a token. Copy the secret now. It is shown only once and is not stored in Ainomos. **3. Fetch events** Your SIEM gets a token with the client credentials grant and calls the events address shown under **Request example**. In Splunk, a REST API modular input can poll it. Each request can ask for up to 1000 events (`limit`), some classes (`class`), and a format (`format`, `json` or `ocsf`). The answer contains `next_cursor`: pass it back as `cursor` on the next request to continue where you stopped. On the first request, `since` skips older history. Every request that returns events writes its own audit record. Click **Revoke** to block a reader at once. ## On your own infrastructure Log shipping runs inside your installation and needs no cloud service. Your operator can trust one company CA for every destination and can open a Splunk at a private address to Ainomos. If the cluster blocks outgoing traffic, the operator allows the Splunk host and port, usually 8088. ## Related * [Audit log](https://docs.ainomos.ch/privacy/audit-log.md) * [System status](https://docs.ainomos.ch/admin/system-status.md) * [Settings](https://docs.ainomos.ch/admin/settings-overview.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.