SigilbaseSyslog, sealed on arrival.
Sending records to Sigilbase through syslog: every delivery receipted, every gap declared, and evidence your auditor verifies offline without an account.
Receivers ship in waves, and this one is in the second. Until then, anything that can send JSON reaches Sigilbase through the events API today.
- Status. Second wave.
- Collected by. A receiver you point at.
- Connects with. A client certificate per connection.
- Category. Receivers and the API.
What can be sent through Syslog
Each record becomes an event in the ledger, kept exactly as it arrived with a hash of those bytes beside it.
-
Delivered by the source
RFC 5424 syslog over TLS with mutual authentication per connection, RFC 3164 tolerated, CEF and LEEF payloads parsed. A self-hosted collector accepts UDP, TCP and TLS inside your network.
-
Event stream
Sequence ids where the sender provides them, so a missing message is declared as a gap rather than passing unnoticed.
How it will be collected
When this receiver ships, senders deliver RFC 5424 syslog over TLS with mutual authentication, and a sequence id where the sender provides one turns a missing message into a declared gap.
The evidence model
What every connector and receiver ships with, whatever the source:
- A receipt per collection: what was asked for, what arrived, the cursor before and after
- A declared gap for any interval nothing covers, never a blank
- A daily settlement once late records can no longer arrive
- The raw record, byte for byte, with its hash
- An evidence bundle anyone can verify offline
What you get
-
Sealed as it arrives
Every record is hashed and chained to the one before; every few minutes the chain is sealed into a signed checkpoint. A changed, deleted or reordered record fails verification at that exact point.
-
Continuity you can show
The receipts chain too, so an auditor sees not only the records but that nothing between them went uncollected, and where a gap was, that it was declared.
-
Verified without us
An export carries the open-source verifier. It runs offline, checks the chain, the receipts and the gaps, and needs no Sigilbase account. How the service is run.
Questions about Syslog
-
Does Sigilbase support Syslog?
Receivers ship in waves, and this one is in the second. Until then, anything that can send JSON reaches Sigilbase through the events API today. Whatever arrives is written to a chained, signed ledger whose evidence anyone can verify offline with the open-source verifier, without a Sigilbase account.
-
What can be sent through Syslog?
Delivered by the source: RFC 5424 syslog over TLS with mutual authentication per connection, RFC 3164 tolerated, CEF and LEEF payloads parsed. A self-hosted collector accepts UDP, TCP and TLS inside your network. Event stream: Sequence ids where the sender provides them, so a missing message is declared as a gap rather than passing unnoticed.
-
How will Syslog evidence be collected and verified?
When this receiver ships, senders deliver RFC 5424 syslog over TLS with mutual authentication, and a sequence id where the sender provides one turns a missing message into a declared gap. Every collection will be receipted in the connection's own stream: what was asked for, what arrived, and the cursor before and after. An interval nothing covers will be declared as a gap, never left blank. Exports carry the standalone verifier, which checks the chain, the receipts and the gaps offline.
Start recording provable history
Chained, sealed, independently verifiable audit logs, from the first event. Free while Sigilbase is in beta.
Questions first? Write to hello@sigilbase.io.