Dawnstar Labs Vardhold Docs

Send events to your SIEM

Vardhold streams every agent event to the tools your security team already uses, in formats that need no custom parser. The SIEM also becomes an independent witness to the local audit log.

2 min readUpdated October 2026Vardhold 0.1 (pre-release)

On this page
  1. Choose a destination
  2. Splunk
  3. Syslog (CEF)
  4. Files (NDJSON)
  5. What an event contains
  6. Check the local log against the SIEM
  7. Export a time range by hand

Choose a destination#

HTTPSSplunkHTTP Event Collector, OCSF 1.1 JSON TLS · TCP · UDPSyslogCEF to any SIEM, TLS per RFC 5425 Local folderFilesOCSF 1.1 NDJSON for any log shipper

Configure exports in the dashboard under Settings → Exports. Changing them needs administrator confirmation. Each destination has a Send test event button that reports exactly what the destination answered. You can turn on more than one.

Splunk#

  1. In Splunk, create an HTTP Event Collector token (Settings → Data inputs → HTTP Event Collector) and allow the index you want.
  2. In Vardhold, turn on Splunk and enter the collector URL, for example https://splunk.example.com:8088/services/collector/event, the token and the index.
  3. Keep Verify TLS certificate on. Send a test event and search for it:
    Text
    index=main sourcetype="vardhold:ocsf"

The token is encrypted at rest with Windows DPAPI and is never shown again. Changing the URL requires entering the token again, so a stored token cannot be sent to a different server.

Syslog (CEF)#

ProtocolUsual portUse it for
tls6514Any collector across the network. TLS per RFC 5425, certificate and host name checked.
tcp514A collector on the same host or a trusted segment. Not encrypted.
udp514A local collector only. Not encrypted, and messages can be lost.

Events use the Common Event Format (CEF), which most SIEMs, including Microsoft Sentinel, IBM QRadar and ArcSight, can ingest.

Files (NDJSON)#

Turn on file export and choose a folder. Vardhold writes one OCSF 1.1 JSON event per line, for a forwarder or log shipper you already run to collect. Protect the folder with permissions and disk encryption, as you would any log.

What an event contains#

Every event carries the agent, process, action, target, rule, verdict and severity, with secrets redacted. In OCSF form, two fields tie it to the local audit chain:

FieldMeaning
metadata.sequenceThe event's id in the local audit log. Ids are consecutive, so a gap means events are missing.
metadata.uidThe event's chain hash

Every hour in which something was logged, Vardhold also records an audit.anchor event holding the current chain head.

Check the local log against the SIEM#

Because the SIEM holds its own copy of the chain head, it can prove the local log was not rolled back or rewritten. Take a recent event's id and hash from the SIEM and run, from an elevated prompt:

PowerShell
vardhold verify --anchor 48211:9f2c4e…

The check passes only if the local log is intact and still holds that exact event. Watch for these in the SIEM too:

  • A gap in metadata.sequence for a machine.
  • Missing hourly audit.anchor events while the machine was in use.
  • Any audit.integrity event, which Vardhold raises as critical when its own daily check fails.

Export a time range by hand#

For an investigation or an auditor, export events directly:

PowerShell
vardhold export --format ocsf --from 2026-10-01 --to 2026-10-15 --agent claude-code --output .\claude-code-oct.ndjson

Formats are ocsf (NDJSON), cef and json.