Events export

A security analyst who looks into an agent incident starts in Splunk, Datadog or the company SIEM, next to the logs of every other system. Events export puts the calls of your agents there. Each allowed or denied tool call, each token exchange and each harness login leaves Xokepoint as an event, with the agent, the person it acted for, the tool, the result and, on a denial, the Reference code that leads back to Quick incident.

The export follows the rule of the trace: tool arguments, evaluated values, facts from customer APIs and tokens never leave in an event.

Where to configure itCopy Anchor Link

Account in the profile menu opens the account area, and the Events export tab lists your destinations. A destination belongs to the person who creates it and covers the workspaces where that person is Admin. One workspace can feed several destinations: during a SIEM migration, both tools receive the same events.

The list shows, for each destination, its type, the workspaces and environments it receives, and its status: Delivering, Failing or Disabled, with the time of the last delivery.

A destinationCopy Anchor Link

Type chooses the protocol:

• OpenTelemetry (OTLP) sends log records to an OpenTelemetry Collector or to a vendor endpoint that accepts OTLP. Protocol is HTTP/protobuf, usually on port 4318, or gRPC, usually on port 4317. For HTTP, give the base URL of the receiver; the events go to its /v1/logs path. A Collector in front of the SIEM reaches most vendors through its exporters.
• Webhook sends one JSON POST for each event to your URL, signed with a secret.

Headers go with every request, for example the token that the SIEM asks for. Their values are stored encrypted and are never shown again. When you edit a destination, a header left blank keeps its saved value. Give the destination a token that can only write events, never an administrator token of the SIEM.

What is exported lists the workspaces where you are Admin. Each one has a Production and a Sandbox switch, so one workspace can send Production only and another both. A workspace with both switches off sends nothing.

Send test event sends one sample event, marked as a test, with the settings of the form, before you save. The answer shows the status and the time, or why it was not delivered.

Endpoint rulesCopy Anchor Link

• The endpoint uses https.
• Its host resolves to a public address. Xokepoint checks the address of every connection, so a loopback, private, link-local or cloud metadata address is refused, also when a DNS name changes after the save. Redirects are not followed.
• Write the host as a name, not as an IP address: a URL with an IP address is refused when you save or test.
• Nothing is configured on the Xokepoint side for a new destination: no allowlist and no firewall rule.

The eventCopy Anchor Link

Every event has the same fields, in schema version 1. A webhook sends it as the JSON body:

{
  "schema_version": 1,
  "event_type": "tool_call",
  "event_id": "tool_call_79",
  "time": "2026-11-13T01:31:27.907Z",
  "workspace": { "id": "f1e33718-8e57-411e-9cd2-fc97819f288f", "name": "Acme" },
  "environment": "production",
  "agent": { "id": "f12a1957-8fdc-40fd-a033-46e953955154", "name": "refunds-assistant" },
  "subject": { "kind": "person", "issuer": "https://idp.acme.com", "id": "maria" },
  "server": { "id": "1a2f538d-7b84-425c-a880-87cc1d812282", "name": "Acme Billing" },
  "tool": "refund_order",
  "outcome": "deny",
  "enforcement": "enforce",
  "reason": "no_grant",
  "reference": "abcd-efgh"
}

A token exchange has no server, tool or enforcement. When the client assertion failed, it has no agent; when the subject token signature was not valid, it has no subject.

In OTLP, each event is a log record. Its severity is INFO for permit and WARN otherwise, its event name is xokepoint.tool_call or xokepoint.token_exchange, its body is a short sentence, and the fields are attributes with the prefix xokepoint., for example xokepoint.agent.name and xokepoint.reference. The resource has service.name = xokepoint, xokepoint.workspace.id and xokepoint.environment.

Webhook signatureCopy Anchor Link

The signature follows Standard Webhooks, so a library of that specification checks it. Each request has three headers:

webhook-id: tool_call_79
webhook-timestamp: 1794533843
webhook-signature: v1,<Base64 HMAC-SHA256>

The signed content is webhook-id, webhook-timestamp and the raw body, joined by dots. The key is the secret without its whsec_ prefix, decoded from Base64. Compare the signature in constant time, and refuse a timestamp more than a few minutes old.

The secret appears once, after you save a new webhook. Copy it then: Xokepoint does not show it again. Rotate secret creates a new one, also shown once; requests signed with the old secret stop passing your check at once.

Delivery and failuresCopy Anchor Link

Events go out in batches. When the destination refuses or does not answer, Xokepoint tries again after 10 seconds, doubling the wait up to 10 minutes. An event not delivered within 72 hours of its record is dropped, and the destination counts it.

A failing destination shows the HTTP status or the gRPC code and the host, for example 401 Unauthorized from collector.acme.com or gRPC Unauthenticated from collector.acme.com. The text of your receiver's answer is not stored or shown. The next successful delivery returns the destination to Delivering.

Deleting a destination drops the events it has not delivered yet. Deleting a workspace removes it from every destination; deleting your account deletes your destinations.