SIEM cookbook - CodeB logs into your Splunk / Elastic / Datadog / Loki / Sentinel / QRadar.
CodeB does not push to your SIEM natively; your SIEM agent tails our per-tenant log files and webhook receiver output. Every path in the recipes below points at the real files CodeB writes today. European Digital Identity Wallet audit events land in the OIDC log file (codeb-oidc-*.log) and the wallet audit log (tmp/wallet-*.log).
Where CodeB writes logs today
Every SIEM recipe below points at these paths on the IIS host:
| Stream | File pattern | Notes |
|---|---|---|
| codeb-conn | App_Data/<tenant>/logs/codeb-conn-<slug>-YYYY-MM-DD.log | SIP-WS + WebRTC join events. |
| codeb-oidc | App_Data/<tenant>/logs/codeb-oidc-YYYY-MM-DD.log | OIDC + European Digital Identity Wallet vp-* audit events. |
| codeb-dial | App_Data/<tenant>/logs/codeb-dial-YYYY-MM-DD.log | SIP INVITEs, transfers, hangups. |
| codeb-cdr | App_Data/<tenant>/logs/cdr/cdr-*.csv | Durable call detail records (per-tenant CSV). |
| codeb-bridge | tmp/codeb-bridge-YYYY-MM-DD.log | WebRTC-to-SIP trunk bridge log. |
| codeb-wallet | tmp/wallet-*.YYYY-MM-DD.log | Wallet-backup + wallet-session-token audit. |
| iis | App_Data/weblogs/W3SVC*/*.log | IIS W3C-format access log. |
LOUD-diag tag format
Every branch in signal.ashx and the bridge emits INF lines with a square-bracket tag. Recommended parser regex: \[([A-Z][A-Z0-9\-]+)\]. Recipes below extract this into a searchable loud_tag field.
Recipes - 6 SIEM back-ends
| SIEM | Agent | Recipe | Snippet |
|---|---|---|---|
| Splunk | Universal Forwarder | inputs.conf tailing per-tenant logs. | splunk-inputs.conf |
| Elastic | Filebeat + Logstash | Filestream inputs + optional Logstash grok. | filebeat-codeb.yml |
| Datadog | Datadog Agent | logs.d/codeb.d/conf.yaml with grok pipelines. | datadog-conf.yaml |
| Grafana Loki | Promtail | scrape_configs + Loki alert rules. | promtail-scrape-config.yml |
| Azure Sentinel | AMA + custom log tables | DCRs per stream + KQL analytics rules. | azure-sentinel-custom-log.md |
| IBM QRadar | WinCollect + Universal DSM | Log Sources + Custom Event Properties + AQL. | qradar-log-source-setup.md |
Recommended alert families
| Family | Match | Severity |
|---|---|---|
| RASP anomaly | loud_tag matches RASP-* | High |
| Tenant isolation breach | contains "TENANT-ISOLATION-BREACH" | Critical |
| mDoc verify failure | stream=oidc AND "MDOC-VERIFY" AND ("fail" OR "denied") | High |
| LOTL chain break | "LOTL-CHAIN" AND ("broken" OR "untrusted") | High |
| WA-POP passkey reject | "WA-POP-DIAG" AND ("reject" OR "denied") | Medium |
| ACL auto-blacklist | stream=conn AND "auto-blacklist" | Medium |
Authentication model
None on the SIEM side - the SIEM agent runs on the IIS host and reads the log files directly. If you feed webhooks into your SIEM as HTTP events instead of tailing files, verify the X-CodeB-Signature HMAC per the webhooks cookbook.
RASP posture
The SIEM cookbook is read-side. Server-side controls at signal.ashx, oidc.ashx, chat.ashx and the bridge (IpAllowGate, per-tenant rate limits, algorithm allow-lists, loud diags) all remain in place; SIEM ingest is a strict superset of what the operator sees on-disk.
NIS2 / DORA / CRA
NIS2 Article 21 requires near-real-time signals to authorities; ingest into your SIEM and route the RASP + tenant-breach families to your incident-response channel. DORA operational-resilience monitoring uses the same feed. CRA product-side auditability is met by per-tenant filesystem+JSON storage - your SIEM inherits the same tenant boundary as the on-disk logs.
FAQ
Structured answers embedded in the schema block above.