SIEM Integration

DB Connect queries MCP Orchestrator's audit table directly and ingests rows on a schedule. Highest fidelity — full OCSF column semantics preserved end-to-end. Recommended approach when SIEM teams already operate Splunk DB Connect for other applications.

1. Install Splunk DB Connect on a search head (Splunk Cloud or Enterprise)
2. Add a Postgres identity using a read-only database user we provision
3. Create a Database Input using the rising-column query template we ship with the integration pack
4. Set sourcetype to mcp:audit:ocsf and target an index of your choice (we recommend a dedicated index like mcp_audit)

The exact query template, column reference, and indexed-extraction config are part of the design-partner onboarding.

Fluent Bit runs as a DaemonSet, tails the orchestrator's structured-JSON stdout (which mirrors the audit_events table), and forwards to a Splunk Universal Forwarder Service. The forwarder ships to your Splunk Cloud HEC endpoint.

fluent-bit.conf

[INPUT]
    Name              tail
    Path              /var/log/containers/mcp-orchestratord-*.log
    Parser            json
    Tag               mcp.audit

[FILTER]
    Name              grep
    Match             mcp.audit
    Regex             event_kind audit

[OUTPUT]
    Name              splunk
    Match             mcp.audit
    Host              splunk-uf.splunk.svc.cluster.local
    Port              8088
    Splunk_Token      ${HEC_TOKEN}
    Splunk_Send_Raw   On

Native HEC client baked into the orchestrator. Configure with siem.provider: splunk and siem.splunk.hecUrl + a token Secret. Roadmapped for v1.7 — design partners can have it earlier.