Trazio by CerebrixOS

← All guides

Cybersecurity

The situation. A finance user's laptop runs PowerShell launched from a Word document, and another host racks up failed logins. You want both flagged, correlated, and answerable in one question, without rewriting your existing security tooling.

Set the five values first. Send records in the protocol your tools already speak; don't wrap them in a proprietary format.

1. What the pipeline needs

Your administrator sets up accepted sources for your real vendor families (for example windows.security, desktop.security, linux.audit, endpoint.security), attaches the security Rule Pack, and configures notifications and correlation if you want them.

2. Send records in the format you already have

Use the write-only protocol token. Pick the line that matches your tool.

# Splunk HEC
curl --fail-with-body -sS -X POST "$PLATFORM_BASE/services/collector/event" \
  -H "Authorization: Splunk $PLATFORM_PROTOCOL_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"event":{"message":"Failed login for admin","source_type":"windows.security","failed_attempts":6}}'

# Loki push
curl --fail-with-body -sS -X POST "$PLATFORM_BASE/loki/api/v1/push" \
  -H "Authorization: Bearer $PLATFORM_PROTOCOL_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"streams":[{"stream":{"job":"auth"},"values":[["1787623200000000000","sshd: 6 failed attempts for root"]]}]}'

# Elasticsearch Bulk
curl --fail-with-body -sS -X POST "$PLATFORM_BASE/_bulk" \
  -H "Authorization: ApiKey $PLATFORM_PROTOCOL_TOKEN" \
  -H 'Content-Type: application/x-ndjson' \
  --data-binary $'{"index":{"_index":"security"}}\n{"message":"Word spawned PowerShell","source_type":"desktop.security","process_name":"powershell.exe","parent_process_name":"winword.exe"}\n'

# Generic NDJSON
curl --fail-with-body -sS -X POST "$PLATFORM_BASE/v1/events/bulk" \
  -H "Authorization: Bearer $PLATFORM_PROTOCOL_TOKEN" \
  -H 'Content-Type: application/x-ndjson' \
  --data-binary $'{"source_type":"windows.security","message":"6 failed logins","failed_attempts":6}\n'

Also supported: Loki Snappy protobuf, Splunk raw HEC, gzip, OTLP protobuf, and Elasticsearch create/index actions. Raw TCP, TLS and UDP syslog, CEF and LEEF use the supplied syslog gateway, which keeps a durable local spool. Workers cannot accept raw TCP or UDP directly. An existing OpenTelemetry Collector, Alloy, Fluent Bit or Vector agent works too (examples are in examples/).

Send one event with your own ID

Use a JWT when you want an event to be exactly-once and queryable straight away.

curl

export RUN_ID="security-check-$(date +%s)"

curl --fail-with-body -sS -X POST \
  "$PLATFORM_BASE/v1/ingest/$TENANT_ID/$PIPELINE_ID" \
  -H "Authorization: Bearer $TENANT_JWT" \
  -H "Idempotency-Key: $RUN_ID" \
  -H 'Content-Type: application/json' \
  -d "{\"source_type\":\"windows.security\",\"event_type\":\"auth_failure\",\"failed_attempts\":6,\"severity\":\"high\",\"message\":\"Tenant verification $RUN_ID\",\"run_id\":\"$RUN_ID\"}" \
  | tee ./security-ingest.json | jq

Python

client.record_event({
    "source_type": "windows.security",
    "event_type": "auth_failure",
    "severity": "high",
    "failed_attempts": 6,
    "message": "6 failed logins for admin",
}, idempotency_key="vendor-event-442")

Node.js

await client.recordEvent({
  source_type: "windows.security",
  event_type: "auth_failure",
  severity: "high",
  failed_attempts: 6,
  message: "6 failed logins for admin",
}, { idempotencyKey: "vendor-event-442" });

3. Check it landed, and that retries don't duplicate

export EVENT_ID="$(jq -r '.event_ids[0]' ./security-ingest.json)"
sleep 5

curl --fail-with-body -sS \
  "$PLATFORM_BASE/v1/query/$TENANT_ID/$PIPELINE_ID?limit=100&include_ai=true" \
  -H "Authorization: Bearer $TENANT_JWT" \
  | jq --arg id "$EVENT_ID" '.results[]? | select(.metadata.event_id == $id)'

Now repeat the same POST with the identical Idempotency-Key and payload. You must get the same event ID back and still see one record. If you see two, the key wasn't stable.

4. Rules that fire

The standard security-endpoint pack:

The pack accepts desktop.security, windows.security and linux.audit, and only the fields event_type, message, failed_attempts, process_name and parent_process_name on them. Records with other fields, or another source type, are refused unless your pipeline is set to accept them. Other vendor families (such as endpoint.security) need their own accepted source. The result is stored on the event as rule_evaluation; check it, plus notification and raw-journal state if you rely on them.

Add your own detections and test them first:

client.dry_run_rule_pack(pack, [
    {"source_type": "linux.audit", "failed_attempts": 8},
])

5. Ask about it

Assistant.

• "Which hosts had repeated failed logins today?"
• "Did anything launch PowerShell from a Word document?"
• "What high-severity events happened in the last hour, and what else did that host do?"

Python.

client.semantic_query("Show high severity endpoint security events from the last 4 hours")

To see what else a flagged host did, fetch the evidence graph around the event:

curl --fail-with-body -sS \
  "$PLATFORM_BASE/v1/query/$TENANT_ID/$PIPELINE_ID/graph?event_id=$EVENT_ID&hops=2&limit=100" \
  -H "Authorization: Bearer $TENANT_JWT" | jq

Edges show recorded links such as the same run ID. Names or timestamps that merely look similar give search hints, not proof.

Troubleshooting