> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guardway.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SIEM Log Reference

> The complete event dictionary for Guardway's SIEM export — every event type, every field, and its mapping onto OCSF, CEF, LEEF and AWS Security Lake.

The field dictionary for Guardway's SIEM export — the analogue of a vendor "Log Reference." It documents every event the gateway emits, every field, and how each field maps onto the **OCSF**, **CEF**, **LEEF** and **AWS Security Lake** output schemas. For destination setup see [Settings → Integrations](https://docs.guardway.ai/platform/settings/integrations.md).

> [!NOTE]
>
> Guardway is an **AI gateway**, so its log model is compact and domain-specific — LLM requests, guardrail decisions, admin audit, behavioral anomalies, and gateway health — rather than the hundreds of networking/UTM log types a firewall emits. "Complete" here means every one of these event types is fully enumerated and richly mapped, and every individual guardrail / audit / system **signature** is catalogued.

The gateway is the **log producer**. The SIEM subsystem taps the event emitter into a durable outbox; a per-destination forwarder drains it, serializes each event into the destination's wire format, and ships it straight to your SIEM. The export is strictly **outbound** — Guardway emits its own events; it does not ingest or re-parse other vendors' logs.

***

## 1. Event types

Guardway emits five event types. The `event_type` field carries the type; several carry a finer sub-type.

| `event_type` | Description | Sub-type | OCSF class |
| - | - | - | - |
| `request_log` | One governed LLM API request — model, provider, tokens, cost, latency, outcome. | `endpoint` | API Activity (6003) |
| `guardrail_event` | A guardrail decision — PII / secret / keyword / prompt-injection / moderation / evaluator. | guardrail kind + `triggered_on` | Detection Finding (2004) |
| `audit_log` | An admin/management action. **Local-only** — reaches a SIEM only when the destination sets `include_audit`. | `action` + `resource_type` | Authentication (3002) / Account Change (3001) |
| `anomaly_event` | A behavioral-drift finding from the anomaly detector. | `entity_kind` | Detection Finding (2004) |
| `system` | Gateway operational events: `gateway_boot`, `config_reload`, `provider_health_change`, `mcp_health_change`. | the concrete token | Base Event (0) |

## 2. Severity

Every event carries `severity` on a **0–10** integer scale (0 = lowest), mapped deterministically onto each schema:

| Guardway `severity` | OCSF `severity_id` | OCSF label | CEF / LEEF `sev` |
| - | - | - | - |
| 0–2 | 1 | Informational | 0–2 |
| 3–4 | 2 | Low | 3–4 |
| 5–6 | 3 | Medium | 5–6 |
| 7–8 | 4 | High | 7–8 |
| 9 | 5 | Critical | 9 |
| ≥10 | 6 | Fatal | 10 |

CEF/LEEF carry the raw 0–10 integer in the header `Severity`/`sev` slot; OCSF carries the `severity_id` enum and echoes the raw value in `severity`.

***

## 3. Output schemas

| Schema | Where | Shape |
| - | - | - |
| **native** (default) | Splunk HEC, webhook NDJSON, Datadog, Azure Sentinel, Google SecOps | The full payload as JSON — every field in this reference; bodies gated by `include_payloads`. |
| **OCSF** | the same JSON transports with `format_options.schema="ocsf"`, plus `ocsf_http` and AWS Security Lake | Typed OCSF object; the rest under `unmapped` (full payload under `unmapped.raw` only when `ocsf_include_raw=true`). Default 1.3.0; opt-in 1.9.0 `ai_operation` profile. |
| **CEF** | `syslog_cef` | ArcSight CEF:0 header + fixed extension keys (§7). |
| **LEEF** | `syslog_leef` | IBM QRadar LEEF:2.0 header + fixed attributes (§7). |
| **OCSF Parquet** | `security_lake` | OCSF 1.3 as Parquet objects, one class per object per UTC event-day. |

***

## 4. `request_log` — API Activity (6003)

A completed LLM request.

| Field | Type | Len / format | OCSF | CEF | LEEF |
| - | - | - | - | - | - |
| `request_id` | uuid | 36 | `unmapped.request_id` | `externalId` | `requestId` |
| `api_key_name` | string | ≤128 | `unmapped.raw` | `cs4` | `apiKeyName` |
| `application_id` | string | ≤128 | `unmapped.raw` | — | `applicationId` |
| `user_email` | string | ≤254 | `actor.user.name` | `suser` | `usrName` |
| `user_id` | string | ≤64 | `actor.user.name`† | — | `usrId` |
| `team_id` | string | ≤64 | `unmapped.raw` | `cs6` | — |
| `model` | string | ≤128 | `ai_model.name`‡ | `cs1` | `model` |
| `upstream_model` | string | ≤128 | `api.service.version` / `ai_model.version`‡ | — | — |
| `provider_name` | string | ≤64 | `api.service.name` | `cs2` | `provider` |
| `endpoint` | string | ≤2048 | `api.operation` | `request` | `endpoint` |
| `status_code` | int | 3 digits | `http_response.code` / `status_id` | `cn3` | `statusCode` |
| `request_outcome` | string | ≤16 | `unmapped.raw` | `outcome` | `outcome` |
| `prompt_tokens` | int | — | `message_context.prompt_tokens`‡ | — | `promptTokens` |
| `completion_tokens` | int | — | `message_context.completion_tokens`‡ | — | `completionTokens` |
| `total_tokens` | int | — | `message_context.total_tokens`‡ | `cn1` | `totalTokens` |
| `cost` | float | USD | `unmapped.raw` | `cfp1` | `costUsd` |
| `latency_ms` | int | — | `duration` | `cn2` | `latencyMs` |
| `error_message` | string | ≤1023 | `status_detail` | `msg` | `msg` |
| `ip_address` | string (ip) | ≤45 | `src_endpoint.ip` | `src` | `src` |
| `client_kind` | string | ≤32 | `actor.app_name` | — | `clientKind` |
| `agent_name` | string | ≤64 | `ai_agent.name`‡ | — | — |
| `trace_id` | string (hex) | ≤32 | `unmapped.raw` | `cs5` | `traceId` |
| `request_body` / `response_body` | string/object | *(gated)* | `message_context.prompt_text` / `response_text`‡ | — | — |
| `gateway_id` / `gateway_name` | string | 36 / ≤64 | `unmapped.*` + `metadata.product` | `cs3` | `gateway` |
| `severity` | int | 0–10 | `severity_id` | hdr | `sev` |

> [!NOTE]
>
> `request_log` has **no** HTTP `method` field (that is emitted only for `audit_log` / MCP).   † `actor.user.name` takes the first of `user_email`, `username`, `user`, `user_id`.   ‡ `ai_model` / `message_context` / `ai_agent` are emitted only under the `ai_operation` profile; prompt/response text additionally requires `include_payloads`.

A successful chat completion to Anthropic `claude-sonnet-5-5`, shown in every format (verbatim formatter output):

```json OCSF 1.3 theme={null}
{
  "class_uid": 6003, "category_uid": 6, "activity_id": 1, "type_uid": 600301,
  "severity_id": 1, "severity": "Informational", "status_id": 1, "status": "Success",
  "time": 1791936000123, "message": "LLM API request: claude-sonnet-5-5",
  "api": { "operation": "/v1/chat/completions",
           "service": { "name": "anthropic", "version": "claude-sonnet-5-5-20260914" } },
  "http_response": { "code": 200 }, "duration": 2150,
  "src_endpoint": { "ip": "203.0.113.45" },
  "actor": { "user": { "name": "alice@acme.com" }, "app_name": "cursor" },
  "metadata": { "version": "1.3.0",
    "product": { "name": "Guardway", "vendor_name": "GuardWay AI", "version": "0.6.14" } },
  "unmapped": { "guardway_event_type": "request_log", "guardway_category": "log",
    "guardway_severity": 1, "gateway_name": "prod-us-east", "org_id": "a1b2c3d4-…",
    "request_id": "7f3a9c21-…" }
}
```

```json OCSF 1.9 (ai_operation) theme={null}
{
  "class_uid": 6003, "type_uid": 600301, "severity_id": 1, "status_id": 1,
  "metadata": { "version": "1.9.0", "profiles": ["ai_operation"],
    "product": { "name": "Guardway", "vendor_name": "GuardWay AI", "version": "0.6.14" } },
  "api": { "operation": "/v1/chat/completions",
           "service": { "name": "anthropic", "version": "claude-sonnet-5-5-20260914" } },
  "ai_model": { "name": "claude-sonnet-5-5", "ai_provider": "anthropic",
                "version": "claude-sonnet-5-5-20260914" },
  "message_context": { "prompt_tokens": 1200, "completion_tokens": 380, "total_tokens": 1580 },
  "actor": { "user": { "name": "alice@acme.com" }, "app_name": "cursor" },
  "duration": 2150, "http_response": { "code": 200 }
}
```

```text CEF theme={null}
CEF:0|Guardway|Gateway|0.6.14|request_log|LLM request|1|rt=1791936000123 externalId=7f3a9c21-… src=203.0.113.45 suser=alice@acme.com request=/v1/chat/completions cs1=claude-sonnet-5-5 cs1Label=model cs2=anthropic cs2Label=provider cs3=prod-us-east cs3Label=gateway cs4=prod-app cs4Label=apiKeyName cs5=4bf92f35… cs5Label=traceId cs6=t-payments cs6Label=channel cn1=1580 cn1Label=totalTokens cn2=2150 cn2Label=latencyMs cn3=200 cn3Label=statusCode cfp1=0.021 cfp1Label=costUsd outcome=ok suid=u-9931
```

```text LEEF theme={null}
LEEF:2.0|Guardway|Gateway|0.6.14|request_log|devTime=1791936000123	devTimeFormat=MILLISECONDS	sev=1	cat=request_log	src=203.0.113.45	usrName=alice@acme.com	outcome=ok	requestId=7f3a9c21-…	gateway=prod-us-east	model=claude-sonnet-5-5	provider=anthropic	traceId=4bf92f35…	totalTokens=1580	promptTokens=1200	completionTokens=380	latencyMs=2150	statusCode=200	costUsd=0.021	usrId=u-9931	apiKeyName=prod-app	endpoint=/v1/chat/completions	applicationId=app-checkout-svc	clientKind=cursor
```

***

## 5. `guardrail_event` — Detection Finding (2004)

A guardrail decision. The specific guardrail kinds — the signatures — are catalogued in §9.

| Field | Type | OCSF | CEF | LEEF |
| - | - | - | - | - |
| `guardrail_event_id` | uuid | `finding_info.uid`§ | — | — |
| `event_type` | string | `finding_info.types` | via `detections` | via `detections` |
| `triggered_on` | string | `unmapped.raw` | in Name | — |
| `action_taken` | string | `unmapped.raw` | `act` | `action` |
| `policy_id` | uuid | `unmapped.raw` | `flexString1` | `policyId` |
| `content_preview` | string (redacted) | `finding_info.desc` | `msg` | `msg` |
| `detected_items` | object | `evidences[]` | `flexString2` | `detections` |
| `slm_engine` | string | `unmapped.raw` | — | — |
| `user_email` | string | `actor.user.name` | `suser` | `usrName` |
| `ip_address` | string | `src_endpoint.ip` | `src` | `src` |
| `severity` | int | `severity_id` | hdr | `sev` |

> [!NOTE]
>
> § `finding_info = { title: "Guardrail event", uid: <related request_id> }`. `finding_info.types` carries the wire `event_type` (e.g. `["pii_detected"]`); `evidences[]` is one `{data:{detection}}` per token in `detected_items.detections`. In CEF/LEEF the SignatureID / `cat` is the top-level `guardrail_event` — the kind is carried in the `detections` extension. Redacted content (`content_preview`) only; raw sensitive text is never emitted.

A PII block on the request side (verbatim formatter output):

```json OCSF 1.3 theme={null}
{
  "class_uid": 2004, "category_uid": 2, "activity_id": 1, "type_uid": 200401,
  "severity_id": 4, "severity": "High", "time": 1791936000090, "message": "Guardrail event",
  "risk_level_id": 3, "risk_level": "High",
  "finding_info": { "uid": "7f3a9c21-…", "title": "Guardrail event", "types": ["pii_detected"],
    "desc": "contact alice at [PII_EMAIL_REDACTED_1], ssn [PII_SSN_REDACTED_1]" },
  "evidences": [ { "data": { "detection": "pii" } }, { "data": { "detection": "email" } },
                 { "data": { "detection": "ssn" } } ],
  "actor": { "user": { "name": "alice@acme.com" } }, "src_endpoint": { "ip": "203.0.113.45" },
  "metadata": { "version": "1.3.0", "product": { "name": "Guardway", "vendor_name": "GuardWay AI" } },
  "unmapped": { "guardway_event_type": "guardrail_event", "guardway_severity": 7,
    "org_id": "a1b2c3d4-…", "request_id": "7f3a9c21-…" }
}
```

```text CEF theme={null}
CEF:0|Guardway|Gateway|0.6.14|guardrail_event|Guardrail: request|7|rt=1791936000090 externalId=7f3a9c21-… src=203.0.113.45 suser=alice@acme.com act=blocked cs1=claude-sonnet-5-5 cs2=anthropic cs3=prod-us-east cn3=400 cn3Label=statusCode flexString1=pol-pii-default flexString1Label=policyId flexString2=pii,email,ssn flexString2Label=detections msg=contact alice at [PII_EMAIL_REDACTED_1], ssn [PII_SSN_REDACTED_1]
```

***

## 6. `audit_log`, `anomaly_event`, `system`

**`audit_log`** → Authentication (3002) when the action is auth-related, else Account Change (3001, `activity_id 99`, `type_uid 300199`). Fields: `action`, `outcome`, `actor_type`/`actor_id`/`actor_email`/`actor_role`, `resource_type`, `resource_id`, `method`, `path`, `status_code`, `ip_address`, `error_message`, `severity`.

> [!WARNING]
>
> Audit events are **local-only** — never sent to the Guardway cloud. They reach a SIEM only when the destination sets `include_audit=true`. Note: the current authentication routes are not audit-wrapped, so a successful login does not itself emit an audit record today — login failures surface via a dedicated webhook. The produced audit stream is dominated by Account Change events from key, provider, policy and user management.

**`anomaly_event`** → Detection Finding (2004) with `finding_info.types=["behavioral_anomaly"]`. Carries no request id, so `finding_info.uid` is the literal `"anomaly_event"` and `message`/`title` are the fixed string `"Behavioral anomaly"` — the specifics are in `finding_info.desc` (the `summary`) and `evidences[]`, where each entry is `{data:<the raw dimension or novelty object>}`.

**`system`** → Base Event (0). The concrete tokens are `gateway_boot`, `config_reload`, `provider_health_change`, `mcp_health_change`, with detail in `unmapped`.

***

## 7. CEF & LEEF reference

**CEF** header: `CEF:0|{vendor}|{product}|{version}|{signatureId}|{name}|{severity}|`. Extension keys: `rt`, `externalId`, `src`, `suser`, `suid`, `request`, `requestMethod`, `act`, `outcome`, `cs1`=model, `cs2`=provider, `cs3`=gateway, `cs4`=apiKeyName, `cs5`=traceId, `cs6`=channel, `cn1`=totalTokens, `cn2`=latencyMs, `cn3`=statusCode, `cfp1`=costUsd, `flexString1`=policyId, `flexString2`=detections, `msg`.

**LEEF** header: `LEEF:2.0|{vendor}|{product}|{version}|{eventId}|` + tab-delimited attributes: `devTime`+`devTimeFormat=MILLISECONDS`, `sev`, `cat`, `src`, `usrName`, `usrId`, `action`, `outcome`, `requestId`, `gateway`, `model`, `provider`, `endpoint`, `method`, `resourceType`, `apiKeyName`, `applicationId`, `clientKind`, `traceId`, `policyId`, `promptTokens`, `completionTokens`, `totalTokens`, `latencyMs`, `statusCode`, `costUsd`, `detections`, `msg`.

**Escaping (UTF-8 throughout):** CEF header escapes `\`→`\\` and `|`→`\|`; CEF extension values escape `\`→`\\` and `=`→`\=`; newlines → space; `msg` truncated to 1023 chars. LEEF header escapes `\` and `|`; attribute values have tabs (the delimiter) and newlines replaced with space.

***

## 8. OCSF class map

| class\_uid | Class | Guardway event → activity\_id → type\_uid |
| - | - | - |
| `6003` | API Activity | `request_log` → 1 → `600301` |
| `2004` | Detection Finding | `guardrail_event`, `anomaly_event` → 1 → `200401` |
| `3002` | Authentication | `audit_log` (auth) → 1 → `300201` |
| `3001` | Account Change | `audit_log` (non-auth) → 99 → `300199` |
| `0` | Base Event | `system` → 0 → `0` |

The `ai_operation` profile (OCSF 1.9, `format_options.profiles=["ai_operation"]`) applies to API Activity only: it stamps `metadata.version="1.9.0"` and adds `ai_model`, `message_context` (and `ai_agent` for agent calls). `unmapped` carries the Guardway identifiers; high-value fields with no OCSF home (`cost`, `request_outcome`, `policy_id`, `action_taken`, …) appear inside `unmapped.raw` only when `ocsf_include_raw=true`.

***

## 9. Signature catalogue

Each guardrail kind carries a stable catalogue ID; sub-detectors are addressed by their detection token (e.g. `GW-GRD-PII / ssn`, `GW-GRD-SEC / aws_access_key`).

| Catalogue ID | Wire `event_type` | Default action | Severity | Representative detections |
| - | - | - | - | - |
| `GW-GRD-PII` | `pii_detected` | Mask / Block | High | `pii` + entity (`ssn`, `credit_card`, `email`, `cpf`, …) |
| `GW-GRD-SEC` | `secret_credential` | Block | High | `secret_credential` + family (`aws_access_key`, `github_pat`, `stripe`, `jwt`, …) |
| `GW-GRD-INJ` | `prompt_injection` | Block / Monitor | Med–High | `prompt_injection`; reasons `instruction_override`, `jailbreak`, … |
| `GW-GRD-ENC` | `prompt_injection` | Block | High | `prompt_injection`, `encoding_bypass` |
| `GW-GRD-MOD` | `hate_speech` / `content_filter` | Block / Flag | Med | `harmful_content` + S-code (`S10` Hate, …), `hate_speech` |
| `GW-GRD-KW` | `keyword_blocked` | Block | Med | `keyword`; `matched_keyword` / `matched_rule` |
| `GW-GRD-AIG` | `ai_guard_blocked` / `ai_guard_unavailable` | Block | High | `ai_guard` |
| `GW-GRD-PRT` | `partner_blocked` | Block | Med | partner engine (`lakera`, `presidio`, `bedrock`) |
| `GW-GRD-EVL` | `guardrail_evaluation_failed` | — (fail-safe) | High | `guardrail_evaluation_failed` |

Moderation uses the Llama Guard **S1–S14** taxonomy (default set enables S1–S5, S7, S9–S13). PII entities and secret/credential families are enumerated in full in the downloadable PDF reference.

***

## 10. Destinations

| destination\_type | Format(s) | Transport | Auth |
| - | - | - | - |
| `splunk_hec` | native / OCSF | HTTP (HEC) | `hec_token` → `Authorization: Splunk <token>` |
| `webhook_ndjson` | native / OCSF | HTTP (NDJSON) | bearer / HEC token / HMAC |
| `ocsf_http` | OCSF | HTTP (NDJSON) | bearer / HEC token / HMAC |
| `syslog_cef` | CEF | syslog TCP/TLS | mTLS optional |
| `syslog_leef` | LEEF | syslog TCP/TLS | mTLS optional |
| `datadog` | native / OCSF | HTTP | API key → `DD-API-KEY` |
| `azure_sentinel` | native / OCSF | HTTP | Entra client secret (Logs Ingestion API) |
| `google_secops` | native / OCSF | HTTP | service-account JSON |
| `security_lake` | OCSF Parquet (1.3) | S3 PUT | AWS IAM role |

**Content & privacy:** `include_payloads` (request/response bodies, off by default), `include_audit` (opt-in to audit events), `ocsf_include_raw` (full native payload under `unmapped.raw`). Guardrail findings carry only redacted placeholders regardless.

**Delivery:** a durable write-ahead outbox; at-least-once, ordered, per-destination delivery; the cursor advances only on acknowledgement, so no event is silently lost and a slow SIEM never blocks the request path or another destination. Dedupe on `request_id` / `finding_info.uid`.

> [!NOTE]
>
> A full **61-page branded PDF** of this reference — with exhaustive per-field dictionaries, per-detector enumerations, worked records in every format, and per-destination parser guidance (Splunk, QRadar, Sentinel, Chronicle) — is available from your Guardway contact.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.