[Bccorb]

Closes #155. Adds operate/stream-audit-events-siem.mdx: audit sinks over OTLP and syslog, Collector recipes, the event field reference, and verifying the hash chain from what the SIEM holds.

Merge with the auth API v0.23.0 release, not before. Audit sinks need API v0.23.0, which is held (fells-code/seamless-auth-api#566). The page opens with a caution, and its versions table marks the console page (fells-code/seamless-auth-admin-dashboard#343) and CLI commands (fells-code/seamless-cli#359) as unreleased. The export and integrity check it also uses are released.

Stacked on #166 (base docs/login-hooks-custom-claims-guide), which is stacked on #165. Merge in that order. This one adds the webhooks guide's links to the new page.

What it covers

• How a sink works: its own cursor, batches of 100, retry forever with backoff to one minute, no dead letter, at least once (dedupe on seq), start after the newest event or replay with startAfterSeq, credentials only as *_AUDIT_SINK_SECRET env var names, and retention held by every sink, disabled ones included, until it is deleted (Brandon's decision of 2026-11-07).
• Settings and setup: OTLP and syslog settings, the console, CLI and admin API, sink status and the test record.
• Recipes: a Collector with the debug exporter to check arrival, then splunk_hec, elasticsearch and datadog, and rsyslog imtcp with TLS for syslog.
• Field reference: the seamless-auth-events/1 line (meanings from AuthEventSchema), the OTLP record and attributes, and each syslog message part.
• SD-ID: shown as seamless@<enterprise number> with a caution that it changes before release, never the RFC 5612 documentation number the branch uses as a placeholder.
• Hash chain: a Python script that checks hashes, links, gaps, an anchor, the manifest, and that the readable fields match the hashed payload (only payload is hashed, so a SIEM copy with an edited field would otherwise pass). It tolerates repeats, since delivery is at least once. A note on what a pass proves and how to compare with GET /admin/auth-events/integrity.
• Cross-link: the retention section of understand/security.mdx mentions sinks, marked as v0.23.0 and unreleased.

How the script was proven

On origin/feat/audit-sinks, a temporary spec (not committed) ran against its own Postgres 18 container: it created an OTLP sink and a syslog sink pointed at local listeners, wrote three audit events (one with a non-ASCII user agent, one login_suspicious), delivered both sinks and ran the export. The script passes on the export, on the three lines taken from the OTLP bodies, and on the three taken from the octet-framed syslog messages, and with a duplicated line and a test record mixed in. It fails on a changed readable field (fields differ from payload), a changed payload (hash_mismatch), a dropped line (sequence_gap) and a wrong anchor. The export is in the page as the sample. The container and spec were removed afterwards.

Vendor and protocol facts, each checked on 2026-11-07

• OTLP receiver, port 4318, /v1/logs, JSON over HTTP: https://github.com/open-telemetry/opentelemetry-collector/blob/main/receiver/otlpreceiver/README.md
• Receiver TLS settings (cert_file, key_file): https://github.com/open-telemetry/opentelemetry-collector/blob/main/config/configtls/README.md
• debug exporter and verbosity: https://github.com/open-telemetry/opentelemetry-collector/blob/main/exporter/debugexporter/README.md
• splunk_hec exporter (token, endpoint, source, sourcetype, index, logs beta): https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/splunkhecexporter/README.md
• elasticsearch exporter (endpoint/endpoints/cloudid, api_key, logs_index, logs beta): https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/elasticsearchexporter/README.md
• datadog exporter (api.key, logs beta): https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/datadogexporter/README.md, and api.site defaulting to datadoghq.com: https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/datadogexporter/examples/collector.yaml
• Datadog's own Collector page (OTLP HTTP exporter to its OTLP intake): https://docs.datadoghq.com/opentelemetry/setup/collector_exporter/
• rsyslog TLS listener (gtls, StreamDriver.Mode="1", Authmode="anon", port 6514): https://docs.rsyslog.com/doc/tutorials/tls_cert_server.html, and imtcp parameters: https://docs.rsyslog.com/doc/configuration/modules/imtcp.html

For review

• Datadog path: the recipe uses the contrib datadog exporter. Datadog's own page now leads with the Collector's OTLP HTTP exporter to https://otlp.<site>; the page links it but does not give that config, because the exporter name there (otlp_http) differs from the one I know (otlphttp) and I could not settle which Collector versions accept which.
• rsyslog closing the connection: the sink counts a batch delivered when the collector closes its side after the sender ends. That was tested against a Node TLS listener in the API's tests, not rsyslog. The page says so.
• Elastic and Splunk field names for the raw body are left out, since they depend on the mapping and I did not verify them.

Testing

• npm run typecheck: 0 errors, 0 warnings, 0 hints.
• npm run lint: exit 0.
• npm run build: 77 pages built. The pre-commit hook ran the build again.
• A script confirmed every internal link and anchor in all three new pages, migrate-from-auth0 and security resolves in dist. The page is in dist/llms.txt and the sitemap.
• Not run: npm run check:matrix, any real SIEM or Collector, and nothing against a released API (none can be until v0.23.0).