TASIP-012: Audit streaming to your SIEM

[ryw]

Status: Draft — open for input · Category: Enhancement

Summary

Stream audit events to your security tooling (Datadog, Splunk, …) in real time, not just exported snapshots, so you can correlate TAS activity with the rest of your compliance infrastructure and alert on it.

Why

Compliance teams live in their SIEM. A point-in-time JSON export doesn't support alerting or correlation; real-time streaming makes TAS a first-class source in the security stack.

Sketch

• Configurable outbound stream of audit events to a SIEM endpoint.
• Standard event schema, at-least-once delivery.
• Scoped per workspace or org.
  (Provisional — the shape changes based on the discussion.)

Open questions

• Which destinations/protocols first (HTTP, syslog, vendor SDKs)?
• Delivery guarantees and backpressure?
• What's the event schema contract we commit to?

How to help

React 👍 if you want this, and comment with your use case, constraints, or pushback. This is a draft Tembo Agent Studio Improvement Proposal (TASIP); your input shapes it before it becomes scheduled work.