PHPackages                             cboxdk/laravel-siem - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. cboxdk/laravel-siem

ActiveLibrary

cboxdk/laravel-siem
===================

The SIEM log-streaming delivery engine for Laravel — a durable transactional outbox, queued batched delivery with retry/backoff/dead-letter/circuit-breaker, SSRF-guarded HTTP egress, encrypted destination secrets, and PII redaction, on top of the framework-agnostic cboxdk/siem core.

v0.1.1(1mo ago)11.5k↑71.4%1MITPHPPHP ^8.4CI passing

Since Jul 15Pushed 1mo agoCompare

[ Source](https://github.com/cboxdk/laravel-siem)[ Packagist](https://packagist.org/packages/cboxdk/laravel-siem)[ Docs](https://github.com/cboxdk/laravel-siem)[ RSS](/packages/cboxdk-laravel-siem/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependencies (13)Versions (3)Used By (1)

Cbox SIEM for Laravel
=====================

[](#cbox-siem-for-laravel)

[![Latest Version on Packagist](https://camo.githubusercontent.com/90cef67095c3c695310d8179318571e898dcc6696a46921bf378441e05936a94/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f63626f78646b2f6c61726176656c2d7369656d2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/cboxdk/laravel-siem)[![Total Downloads](https://camo.githubusercontent.com/aac87a6edd32f692f4884f856ff3bb21d3ffebcc66b53972c4d7ac3aa7b1247a/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f63626f78646b2f6c61726176656c2d7369656d2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/cboxdk/laravel-siem)[![PHP Version](https://camo.githubusercontent.com/e5ffd9189be7f24bd8f1e56372442eb6b59ad4449b6f13ed3cc08c79417be41e/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f63626f78646b2f6c61726176656c2d7369656d3f7374796c653d666c61742d737175617265)](https://camo.githubusercontent.com/e5ffd9189be7f24bd8f1e56372442eb6b59ad4449b6f13ed3cc08c79417be41e/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f63626f78646b2f6c61726176656c2d7369656d3f7374796c653d666c61742d737175617265)

The SIEM log-streaming **delivery engine** for Laravel: a durable transactional outbox, queued batched delivery with retry, dead-letter, and a per-stream circuit breaker, SSRF-guarded HTTP egress, encrypted destination secrets, and per-field PII redaction — shipping normalized security events to Splunk HEC, Elastic (ECS), Graylog (GELF), ArcSight/syslog (CEF), or any HTTP JSON collector.

This package is the **Laravel wrapper** over the framework-agnostic [`cboxdk/siem`](https://github.com/cboxdk/siem) core. The core owns the event model and the formatters (the *shape* of the data); this package owns *delivery* (the network, the durability, the secrets). An audit binding in [`cboxdk/laravel-id`](https://github.com/cboxdk/laravel-id) consumes this layer to stream a tamper-evident audit trail — that binding is a separate package.

Installation
------------

[](#installation)

```
composer require cboxdk/laravel-siem

php artisan vendor:publish --tag="siem-migrations"
php artisan vendor:publish --tag="siem-config"   # optional
php artisan migrate
```

The service provider is auto-discovered. Destination secrets use Laravel's encrypter, so an `APP_KEY` is required (every Laravel app has one).

At a glance
-----------

[](#at-a-glance)

```
use Cbox\LaravelSiem\Contracts\{LogStreams, StreamDispatcher};
use Cbox\LaravelSiem\Enums\Destination;
use Cbox\Siem\ValueObjects\SiemEvent;

// 1. Register a destination (endpoint SSRF-checked; secret encrypted, revealed once).
app(LogStreams::class)->create(
    name: 'splunk-prod',
    destination: Destination::SplunkHec,
    endpointUrl: 'https://http-inputs.example.splunkcloud.com',
    secret: 'your-hec-token',
    redaction: ['password' => 'drop', 'email' => 'hash'],
);

// 2. In your own DB transaction, write the event to the outbox (a cheap insert).
DB::transaction(function () use ($event) {
    // ... your business write ...
    app(StreamDispatcher::class)->dispatch($event, app(LogStreams::class)->enabled());
});

// 3. The queued pump batches, redacts, formats, and ships it — off the request thread.
```

What it guarantees
------------------

[](#what-it-guarantees)

- **Deny-by-default** — no enabled stream, nothing delivered.
- **At-least-once, unordered** — the outbox row commits in your transaction; a rolled-back caller leaves no orphan. Duplicates are possible; dedup by event id.
- **Never blocks the request** — all delivery is queued.
- **Bounded everything** — triple-bounded batches (records/bytes/age), bounded exponential backoff with jitter, a hard retry cap into a dead-letter, a bounded outbox with an explicit backpressure policy, and a per-stream circuit breaker.
- **Safe egress** — SSRF-guarded and DNS-pinned, TLS verification always on, secrets encrypted at rest and scrubbed from logs, PII redacted before formatting.

Destinations
------------

[](#destinations)

DestinationSIEMFraming`splunk_hec`Splunk HECNDJSON to the collector event endpoint, `Authorization: Splunk ``elastic_ecs`Elastic / KibanaECS JSON documents (NDJSON)`graylog_gelf`GraylogGELF 1.1 over HTTP (never UDP)`cef_http`ArcSight / syslogCEF lines over HTTP`generic_json`any HTTP collectorneutral single-line JSONTesting
-------

[](#testing)

Compose `Cbox\LaravelSiem\Testing\InteractsWithLogStreams` into your `TestCase` to run the whole pipeline in memory: `fakeStreamSink()` binds an in-memory `FakeStreamSink`, `createLogStream(...)` registers through the real registry, and `pumpStream($id)` runs a delivery cycle synchronously. `FakeHttpTransport` programs the HTTP fake for testing the real `HttpStreamSink`.

Requirements
------------

[](#requirements)

- PHP 8.4+
- Laravel 12.x or 13.x
- A queue connection, a database, and an `APP_KEY`.

Documentation
-------------

[](#documentation)

Full documentation lives in [`docs/`](docs/index.md).

The event core
--------------

[](#the-event-core)

The normalized `SiemEvent`, the formatters, and their escaping/threat model are provided by [`cboxdk/siem`](https://github.com/cboxdk/siem). This package claims only the Laravel delivery layer.

Credits
-------

[](#credits)

- [Sylvester Damgaard](https://github.com/cboxdk)

License
-------

[](#license)

The MIT License (MIT). See [LICENSE.md](LICENSE.md).

###  Health Score

44

—

FairBetter than 90% of packages

Maintenance90

Actively maintained with recent releases

Popularity23

Limited adoption so far

Community10

Small or concentrated contributor base

Maturity42

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

2

Last Release

46d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/b9761a79e61f2d5b9d650510dfb3555da18daf38f027aa84012c937e397e39a7?d=identicon)[cboxdk](/maintainers/cboxdk)

---

Top Contributors

[![sylvesterdamgaard](https://avatars.githubusercontent.com/u/2431914?v=4)](https://github.com/sylvesterdamgaard "sylvesterdamgaard (2 commits)")

---

Tags

auditcefcircuit-breakerdead-letterdeliveryelastic-ecsgraylog-gelflaravellog-streamingoutboxredactionsecurity-eventssiemsplunk-hecssrflaravelAuditdeliverySIEMredactioncircuit breakerssrfoutboxdead-lettercefsplunk-heclog-streamingsecurity-eventselastic-ecsgraylog-gelf

###  Code Quality

TestsPest

Static AnalysisPHPStan

Code StyleLaravel Pint

### Embed Badge

![Health badge](/badges/cboxdk-laravel-siem/health.svg)

```
[![Health](https://phpackages.com/badges/cboxdk-laravel-siem/health.svg)](https://phpackages.com/packages/cboxdk-laravel-siem)
```

###  Alternatives

[laravel/scout

Laravel Scout provides a driver based solution to searching your Eloquent models.

1.7k59.5M717](/packages/laravel-scout)[psalm/plugin-laravel

Psalm plugin for Laravel

3365.5M359](/packages/psalm-plugin-laravel)[laravel/pulse

Laravel Pulse is a real-time application performance monitoring tool and dashboard for your Laravel application.

1.7k17.6M166](/packages/laravel-pulse)[illuminate/auth

The Illuminate Auth package.

10528.8M1.4k](/packages/illuminate-auth)[illuminate/broadcasting

The Illuminate Broadcasting package.

7227.7M256](/packages/illuminate-broadcasting)[api-platform/laravel

API Platform support for Laravel

58190.1k22](/packages/api-platform-laravel)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)