SIEM integration

PromptGlass streams AI usage events, detections and policy actions to your SIEM in near real time, so AI data-leak alerts land in the same queue as the rest of your security signals. Supported outputs are HTTP (vendor-native collectors), syslog (RFC 5424 over TLS) and CEF. Prompt content is never sent to the SIEM unless you explicitly include it.

Destinations

SIEM	Method	Format
Splunk	HTTP Event Collector	JSON, sourcetype promptglass:event
Microsoft Sentinel	Logs Ingestion API (DCR)	Custom table PromptGlass_CL
Elastic	Elasticsearch bulk API or Elastic Agent HTTP input	ECS-mapped JSON
IBM QRadar	Syslog TLS	CEF / LEEF
Google SecOps (Chronicle)	Ingestion API	UDM-mapped JSON
Any	Syslog / webhook	JSON or CEF

Configure

apiVersion: promptglass.ai/v1
kind: Destination
metadata: { name: splunk-prod }
spec:
  type: splunk-hec
  url: https://splunk.example.com:8088/services/collector
  tokenSecret: splunk-hec-token
  index: security_ai
  filter:
    minSeverity: medium              # only events that triggered alert/coach/redact/block
    include: [detections, actions, admin_audit]
  fields:
    includeContent: false            # never ship prompt text by default

promptglass destination apply -f splunk.yaml
promptglass destination test splunk-prod

Event example (JSON)

{
  "event_id": "evt_01JD4Q7Z9K2",
  "ts": "2026-11-02T14:03:11Z",
  "sensor": "extension",
  "actor": { "pid": "u_7f3a91", "department": "Finance", "upn": null },
  "app": { "id": "chatgpt-personal", "sanctioned": false, "risk": "high" },
  "direction": "paste",
  "detections": [{ "class": "pci.card", "count": 3, "confidence": "high" }],
  "policy": { "name": "customer-data", "rule": "redact-customer-pii", "action": "redact", "mode": "enforce" },
  "severity": "high"
}

actor.upn is null unless the destination is allowed to receive identities (fields.identity: true), which requires a privacy approver.

Sentinel analytics rule (KQL)

PromptGlass_CL
| where Severity in ("high", "critical") and Detections has "secret."
| summarize Events = count(), Apps = make_set(App_Id) by Actor_Pid, Department, bin(TimeGenerated, 1h)
| where Events >= 2

Splunk search

index=security_ai sourcetype=promptglass:event policy.action IN ("block","redact")
| stats count by app.id, detections{}.class, actor.department