SIEM: the estate audit and alerting view

The SIEM is a role-aware view over the estate’s audit stream: the security and observability events every H-Series backend emits, anchored on chain as operator-signed records and narrated in plain English. It answers “what did the estate do, and what went wrong,” with every line independently verifiable on the public mirror node. Who you are decides what you see.

What it is

Every backend emits alertable events (a settled payment, a registration, a refused release, and so on) to a dedicated Hedera audit topic, 0.0.10619840, as operator-signed, self-verifying records. The hub reindexes that topic and serves it back through three views:

• Operator. All products, all events, across every account. Includes a treasury revenue rollup (settled payments grouped by chain), an incident summary (a deterministic gloss plus an optional AI narration), and per-event detail with the on-chain reference and signature. Gated: operator SSO (an allowlisted Google identity) or the shared operator token.
• Customer (tenant). Only events for one identity, the customer’s own. Pinned server-side to their subject so nothing but their own events can return. A customer reaches it by connecting a wallet or entering their CAIP-10 identity.
• Public. Aggregate audit-trail health (event counts by severity over a window, product count, whether anchoring is on) and a demo feed of recent non-monetary events. No per-event revenue, no subjects, no narration. Loads for everyone.

Events carry a severity bucket: page (urgent), alert, and review. The feed color-codes each, and the operator view can filter by severity, product, event type, and a specific customer subject.

How to use it

The dashboard is at h-series.xr-utilities.com/siem.

1. Open the page. Everyone sees the public audit-trail health panel and, logged out, the public demo feed.
2. Operators: sign in. Click “Sign in with Google” (operator SSO), or paste the operator token in the Operator token field. The server verifies the token’s issuer, audience, and an operator allowlist, or the shared token.
3. Filter (operator). Set severity, product (for example h-index), event (for example payment.settled), or a customer subject, then Load. The Payments button filters to settled payments and shows the treasury revenue rollup. Auto-refresh every 60s is optional.
4. Read the summary. The incident summary block shows a deterministic gloss and, when the LLM tier is enabled, an AI narration. Both are advisory.
5. Verify a line. Expand any event to see its public-safe payload, the chain reference (topic id + sequence), the consensus timestamp, the signature, and a “verify this message on chain” link to the exact record on the Hedera mirror node.
6. Customers: see your own activity. Connect a wallet or type your CAIP-10 identity (for example eip155:8453:0x...) in the Customer box, then Load. You get only your own events. A signed-in customer who is not an operator is routed to this view automatically.

Good to know

• This is behind a role gate. The full operator feed requires operator SSO or the shared token; the customer view requires the customer’s own identity. Only the aggregate health and the demo feed are open.
• The narration is advisory. The deterministic gloss is always present; the AI incident summary appears only when the model tier is enabled server-side. Neither alters the anchored record.
• Public-safe only. Anchored fields are the event tag, bucket, severity, product, timestamp, and bounded scalars. Subjects are CAIP-10 addresses or salted OIDC commitments, never raw PII. Secrets and payloads are never written.
• The alert worker reads the mirror, not the hub, so severity-tiered digests still fire even if the hub is down. That is separate from this dashboard, which reads the hub’s reindexed view.
• Revenue is per chain. Treasuries are shared per chain, so the rollup sums settled-payment amounts by chain, which maps to each treasury’s receipts.

Where to go next

• New to the suite? Read Start here for how the products fit together.
• For a single agent’s activity and spend across the suite (not the estate-wide operator feed), see Reporting.
• The SIEM hub and its tooling live in H-Index. See the H-Index guide.