Send audit records to a SIEM

tovio audit export --format jsontovio audit export --format csvtovio audit export --format ceftovio audit export --format syslogtovio audit export --format cef --output audit.ceftovio audit export --format cef --tls <host:port>

Exports the signed audit chain. cef and RFC 5424 syslog are the formats most SIEMs ingest directly; json and csv preserve the same row shapes audit log already produces, so a pipeline built on one works on the other.

Where the payload goes

• --output <file> writes it to disk as an atomic write, so a crashed export never leaves a half-file that looks complete.
• --tls <host:port> delivers it to a collector over bounded, server-authenticated TLS 1.3.
• With neither, the payload goes to stdout — which is what you want when piping into something else.

Both destinations may be given at once: write the file and ship it.

Collector authentication

tovio audit export --format syslog --tls <host:port> --cert <collector.der>tovio audit export --format cef --tls <host:port> --server-name <dns-name>

--cert pins the collector's DER certificate. Without it, the platform CA roots are used. There is no skip-verification mode, deliberately — an audit feed delivered to an unauthenticated endpoint is a log you cannot rely on.

--server-name overrides the DNS name checked against the certificate; by default it is derived from the --tls address. You need it when the collector's certificate does not name the address you connect to.

Syslog over TLS uses RFC 6587 octet counting, so a collector expecting octet-framed messages will parse the stream without extra configuration.

What the SIEM formats carry

CEF and syslog add the signed entry hash and the authenticated principal, the source, device, and session, the authorization attributes and capability chain, any recorded justification, the token, and path metadata. They never carry object content or protected-file content.

A workable setup

1. Run tovio audit verify on the source before each export, so you are not shipping a chain you have not checked.
2. Export on a schedule rather than dumping everything each time.
3. Ship over --tls to a pinned collector.
4. Archive locally behind a signed checkpoint once exported — see the archiving article.

What is not in an export

Content. Records say access happened; they do not carry what was accessed, and secret values are masked.

The two other formats

--format also accepts prov-json and in-toto. Those are not the audit chain at all — they export a single target's lineage graph for a provenance auditor, and they take a target argument. See the provenance export article. Passing a target to one of the four chain formats above does nothing and warns.