SIEM integration

Use the built-in Crawdad dashboard, or pipe security events into Grafana, Splunk, Datadog, or any OpenTelemetry-compatible system. Both, ideally. Only structured metadata leaves the machine, raw prompts, responses, and action parameters never do.

Built-in dashboard

The Crawdad dashboard at localhost:7750 provides real-time security visualization: detections, agent identities, behavioral anomalies, red team results, and compliance reports. No configuration required.

Grafana (pre-built dashboard)

Import the pre-built Grafana dashboard for professional time-series visualization.

Quick start

  1. Enable OTLP export in Crawdad Settings (point to your collector)
  2. Download crawdad-dashboard.json
  3. In Grafana: Dashboards → Import → Upload JSON
  4. Select your Prometheus and Loki data sources

Panels included: Detections (24h stat + time-series + by category/layer), scan latency percentiles, agent identities table, anomalies by severity, red team detection rate trend, system health, error rate.

Requirements: Grafana 10+, Prometheus or compatible metrics store, Loki or compatible log store, an OTLP collector (e.g., Grafana Alloy, OpenTelemetry Collector).

Splunk HEC

Crawdad exports events to Splunk via HTTP Event Collector in CIM-compliant format.

Setup

  1. In Splunk: Settings → Data Inputs → HTTP Event Collector → New Token
  2. In Crawdad Settings → Exports: enable Splunk HEC, enter endpoint URL and token
  3. Click "Test connection" to verify

Events exported: Detections (CIM Alerts), anomalies, sensitive syscall events, CVE observations, red team summaries, system health.

CIM compliance: Detection events include src, dest, signature, category, severity, action, vendor, product fields compatible with Splunk's Common Information Model.

OpenTelemetry (OTLP)

Export to any OTLP-compatible system: Grafana, Datadog, Honeycomb, Jaeger, Tempo, and more.

Setup

  1. In Crawdad Settings → Exports: enable OpenTelemetry
  2. Enter your OTLP endpoint (e.g., http://localhost:4318 for a local collector)
  3. Add any required auth headers (e.g., Honeycomb API key)

Signals exported: Structured logs for all events (detections, anomalies, syscalls, CVEs, health). Metrics for counters and gauges (detection counts, scan latency, identity stats, red team rate).

Privacy

When you enable Splunk or OpenTelemetry export, Crawdad sends event metadata to your chosen destination.

Exported: Detection types, severity, scan times, pattern names, agent identity IDs, anomaly descriptions, CVE IDs, component health status.

Never exported: Raw user content or prompts. API request or response bodies. File contents from sensitive accesses (only paths). Credentials or tokens (always redacted). Session content beyond IDs.

Your on-device guarantee is preserved: raw content never leaves the machine. Only structured metadata leaves the machine, and only to destinations you explicitly configure. Enforced by architecture, not policy.

Docs → · Home →