Asiri
Login Configure export
Audit export

Keep the trail in your own telemetry stack.

Send Asiri audit events to an OpenTelemetry Collector from the hosted backend, or push them directly from a machine inside your network. Your SIEM keeps the long history; Asiri stays focused on secret access.

Open dashboard settings Use the CLI
Two delivery routes

Choose based on where your collector lives.

Both routes use OTLP/HTTP protobuf, gzip, stable event IDs, and batches of audit logs. Neither route changes strict audit acknowledgement or grants access to secrets.

Hosted backendContinuous Pro+ delivery to a public HTTPS collector. Asiri queues each retained and new event, retries failures, and shows delivery health in the workspace dashboard.
Direct CLIOne-shot delivery from your own machine to public or private collectors. Collector credentials come from an environment variable and stay out of the command line.
Collector firstPoint Asiri at an OpenTelemetry Collector, then route onward to your SIEM or log store with the exporter you already operate.
Delivery semantics

Visible retries. No silent loss.

Hosted export keeps a durable delivery record for every audit event. A collector response in the 2xx range marks the batch delivered. Timeouts and non-2xx responses remain queued with bounded backoff.

Delivery is at least once. Use asiri.audit.event_id in your collector or SIEM when exact deduplication matters.

Exportedmetadata, not values
Identity
Actor type and stable actor identifier.
Decision
Action, allowed or denied result, and reason.
Target
Workspace, scope, and secret-name hash when present.
Context
Sanitized runtime labels and event metadata.
Time
Original event timestamp and stable event ID.
Excluded
Plaintext secret values, private keys, and stored collector credentials.
Retention

Asiri keeps a useful window. Your stack keeps the archive.

Retention and export are separate controls. Deleting an old event from Asiri does not delete the copy already accepted by your collector.

Free7 days in Asiri, with daily cleanup.
Paid90 days in Asiri, with daily cleanup.
Your collectorYou set the retention, access controls, routing, and downstream cost.
Private collectors

Push from inside your network.

The CLI can send retained local audit events directly to an OTLP logs endpoint. Put the bearer token in an environment variable so it does not appear in shell history or the process list.

Direct push is intentionally one-shot. Run it from your scheduler when you want a customer-operated delivery path.

private networkno Asiri relay

$export OTEL_EXPORT_TOKEN='…'

$asiri audit push --workspace oclan-co \ --endpoint http://otel-collector:4318/v1/logs \ --bearer-env OTEL_EXPORT_TOKEN

✓ 4,812 audit events accepted in 49 batches

delivery: at least once · content: OTLP protobuf + gzip

Workspace owners

Connect a collector and test it before relying on it.

The dashboard shows the endpoint, authentication posture, queue depth, last successful delivery, and current error. Pause, test, edit, or remove the destination without touching local vaults.

Configure audit export Review the security model