SIEM-native · Stateless license + RBAC via OIDC · Customer-controlled retention
Session-level events, user-level events, configuration changes, and AI prompt metadata stream to your SIEM. Your IdP enforces roles. Your retention policy applies. Element34 SBOX writes audit events for the team that signs the regulator's letter.
The categories below are stable across deployments. The exact field-by-field schema is confirmed during procurement scoping and shared under NDA.
| Field | Category | Example | Notes |
|---|---|---|---|
| session_id | Session | s_9f1c4a2b | Unique per test session |
| user_id | User | u_42b1 | Sourced from customer IdP via OIDC, with SCIM on roadmap |
| timestamp | Session, User, Config | 2026-06-04T14:22:01Z | UTC, ISO 8601 |
| action | User, Config | test.executed | Action verb, dotted namespace |
| resource | Session, Config | checkout.spec | Resource path or test identifier |
| tenant_id | System | cust_acme | Single value per deployment in single-tenant SBOX |
| region | System | eu-central-1 | Region pinning value |
| ai_prompt_hash | AI | sha256:b3c2... | Hash only; prompt content not stored Element34-side |
| extended fields | Customer-scoped | on request | Additional fields confirmed during procurement scoping. |
Three SIEM destinations supported natively. Connector specifics (Splunk HEC, QRadar DSM, Sentinel Log Analytics, or S3 lifecycle) are confirmed during deployment scoping.
SBOX streams events to Splunk HEC inside the customer environment. Field mapping aligns with Splunk Common Information Model where applicable.
SBOX streams events to QRadar through the customer-deployed collector. Event names align with QRadar QID assignments through DSM editor where the customer has standardized.
SBOX streams events to a customer Sentinel workspace. Custom log table is provisioned at deployment time; KQL-friendly field shapes.
Identity is sourced from the customer IdP. Roles map to customer IdP attributes via OIDC today, with SCIM on the roadmap. Stateless licensing applies across every deployment. Specific role names are confirmed during deployment scoping.
| Role category | Scope | Typical user |
|---|---|---|
| Platform administration | Full platform admin: deployment configuration, executor scale, integration setup, role assignment. | Platform engineering lead, DevSecOps lead |
| User and project management | Workspace-level admin: project setup, integration configuration within scope, member management. | QA engineering manager, test platform owner |
| Test creation | Author and edit tests, configure runs, view results within workspace. | Senior SDET, test author |
| Test execution | Execute existing tests, view results within workspace. No author rights. | QA engineer, CI service account |
| Results visibility | View results, dashboards, and session reconstructions. No execute or author rights. | Engineering manager, product manager, stakeholder |
| Audit-log access | Read-only access to the audit trail and SBOX session reconstruction surfaces. No platform configuration access. | Compliance officer, internal audit, regulator-facing review team |
Retention follows customer policy. SBOX delivers audit events to the customer SIEM where the customer's existing immutability and retention policies apply.
Retention follows the customer's S3 lifecycle policy or the customer-configured SBOX setting. Video, screenshots, and session metadata follow customer-set retention rules. Video storage offloads to customer S3 or object storage with customer-defined lifecycle policies.
Logs are delivered to the customer SIEM where customer immutability policies apply. SBOX does not promise log immutability inside the platform itself. The customer's existing immutability and retention policies govern the audit trail end-to-end.
If the customer SIEM endpoint is unreachable, SBOX buffers events and replays once the endpoint is reachable. Buffer behavior, retry policy, and dead-letter handling are configured during deployment.
Your audit and governance team will get the audit field catalog, the SIEM integration guide for Splunk, IBM QRadar, and Microsoft Sentinel, and a walk-through of the OIDC-authenticated RBAC model (SCIM on roadmap). Bring your compliance officer to the call.
