telemetry

Event metadata (fleet sensors)

Every mask, MCP enforcement, and ingress proxy call can include:

Stored in workspace events as sensorMetadata (metadata-only — no prompt bodies in default event ingest).

Policy stream

GET /api/workspace/policy-stream emits SSE:

• policy — full snapshot when revision changes
• heartbeat — keep-alive every 4s

Revision is SHA-256 of { mcpToolPolicy, redactionProfile }.

OpenTelemetry (hooks)

Recommended export labels:

blekline.ingress.action=mask|block|allow
blekline.client.surface=cursor
blekline.model.provider=openai
blekline.entities.masked=3

Wire OTel in your sidecar or agent runtime; Blekline control plane emits structured audit rows via appendAudit.

Rate limits

Adaptive limits via Upstash Redis (lib/server/rate-limit.ts). Keys:

• api:mask
• api:mcp:enforce-tool-call:post
• api:ingress:openai:post
• api:ingress:anthropic:post

Audit export

Governance workspaces: GET /api/audit?limit=200 returns JSON audit rows. Add format=csv for downloadable evidence. Activity UI also exports ingress events as CSV.

SIEM

Configure HTTPS webhook sink on Integrations (Governance+):

• GET/POST/DELETE /api/integrations/siem — persist encrypted endpoint + bearer token
• POST /api/integrations/siem/probe — delivery test
• Formats: JSON (default) or CEF
• Automatic forward on audit events when forwardOnAudit is enabled

Next steps: AI Enablement Stack · Telemetry spec · Trust boundaries · Open workspace · Report issue