SIEM Event Schema

This document describes the event fields a customer can receive when WitnessAI forwards alert, prompt, and audit data to a configured SIEM destination.

Not every field appears on every event. Field presence depends on the event type, the configured SIEM forwarding options, the AI application, and whether the prompt included files or triggered guardrail results.

1. Delivery Formats

WitnessAI can deliver SIEM events in the following formats:

JSON array: multiple event envelopes in one JSON array.
NDJSON: one event envelope per line.
AWS S3 object: one event envelope per JSON object.

In all formats, the payload uses the same event envelope and inner event fields.

2. Event Envelope

Each SIEM event is wrapped in an envelope. The envelope is the outer object received by the SIEM.

Field	Type	Required	Description	Example
time	integer	No	Unix timestamp in seconds for when the event was emitted.	1716400000
host	string	No	Host value associated with the WitnessAI forwarding environment.	witness-host
source	string	No	Event source name.	witnesssource
sourcetype	string	No	Event source type.	json
index	string	No	Customer-configured SIEM index. Some environments may send “null” if no index is configured.	main
event	object	Yes	Event payload container. Contains prompt or audit.	{ “prompt”: “{…}” }
fields	object	No	Additional event metadata.	{ “request_id”: “…” }

event.prompt and event.audit are JSON-encoded strings. SIEM parsers should parse the string value as JSON to access the inner fields documented below.

3. Event Types

Event Type	Envelope Field	Description
Prompt or alert event	event.prompt	Prompt activity, including alert details when present.
Audit event	event.audit	Administrative or user action audit data.

4. Prompt And Alert Payload

Prompt and alert events are delivered under event.prompt. Alerts use the same prompt payload and include populated risk information in score_cards and, when present, alerts .

The subsections below describe nested parts of the same parsed event.prompt object. They are not separate SIEM events and do not need to be combined manually.

4.1. Prompt Fields

Field	Type	Description	Example Values
id	string	Prompt ID.	UUID
conversation_id	string	Conversation ID associated with the prompt.	UUID
input	string	Original user prompt, when enabled for SIEM forwarding.	Summarize this policy document
sanitized	string	Sanitized prompt text, when enabled for SIEM forwarding.	Summarize this policy document
llm_output	string	Model response/output, when enabled for SIEM forwarding.	Here is a summary…
desanitized	string	Desanitized response/output, when enabled for SIEM forwarding.	Here is a summary…
action	string	Action applied to the prompt.	allowed, blocked, warned
source	string	Source of the prompt.	client, api
application_name	string	Application associated with the prompt.	witness-client, ChatGPT, Claude, Copilot
application_version	string	Application version, when available.	1.0.0
proxy_name	string	Proxy name, when available.	witness-proxy
proxy_version	string	Proxy version, when available.	1.0.0
provider_name	string	Al provider name.	openai, anthropic, google
model_name	string	Al model name.	gpt-4, claude-sonnet, gemini-pro
filter_output	object	Additional classification output. Shape varies by guardrail or classifier.	{ “topic”: “Security” }
warning_count	integer	Number of warning results.	0, 1
error_count	integer	Number of error results.	0, 1
incomplete_count	integer	Number of incomplete results.	0, 1
result	string	Overall processing result.	pass, blocked, failed
risk_score	integer	Overall risk score. Higher values indicate more risk.	0, 1, 2, 3

input_score	integer	Risk score for user input, when present.	0, 1, 2, 3
output_score	integer	Risk score for model output, when present.	0, 1, 2, 3
combined_score	integer	Combined input and output risk score, when present.	0, 1, 2, 3
prompt_index	integer	Prompt sequence number within the conversation.	1, 2, 3
user_initiated_time	string	Time the user initiated the prompt, when available.	RFC3339 timestamp
policy_id	string	Policy ID evaluated for the prompt.	UUID
policy_name	string	Policy name evaluated for the prompt.	Global AI Policy
policy_version	integer	Policy version evaluated for the prompt.	1
created	string	Prompt record creation time, when present.	RFC3339 timestamp
updated	string	Prompt record update time, when present.	RFC3339 timestamp
tags	array	Tags associated with the prompt, when present.	[ ]
attachments	array	Attachment metadata, when present.	See Attachment Fields
prompt_metrics	array	Prompt metrics, when present.	See Prompt Metric Fields
conversation	object	Conversation context, when present.	See Conversation Fields
score_cards	array	Guardrail or classifier results, when present.	See Score Card Fields
alerts	array	Alert records, when present.	See Alert Fields

4.2. Conversation Fields

Field	Type	Description	Example Values
id	string	Conversation ID.	UUID
user_id	string	User ID associated with the conversation, when available.	UUID
title	string	Conversation title, when available.	Policy review
prompt_count	integer	Number of prompts in the conversation, when available.	1, 2
last_prompt_risk_score	integer	Risk score of the most recent prompt, when available.	0, 1, 2, 3
created	string	Conversation creation time, when present.	RFC3339 timestamp
updated	string	Conversation update time, when present.	RFC3339 timestamp

4.3. Conversation User Fields

When present, conversation.user contains user context associated with the conversation.

Field	Type	Description	Example Values
id	string	User ID.	UUID
email	string	User email.	user@example.com
user_name	string	Username.	user.name

4.4. Attachment Fields

When present, attachments[] contains metadata for files processed as part of a prompt event.

Field	Type	Description	Example Values
file_id	string	Attachment file ID.	UUID
file_location	string	Attachment storage path or location reference.	/attachments/gemini/…/file.pdf
file_name	string	Original file name.	example.pdf
file_size	integer	File size in bytes.	19698

4.5. Prompt Metric Fields

When present, prompt_metrics[] contains timing or size metrics associated with prompt processing.

Field	Type	Description	Example Values
metric_name	string	Raw metric name.	g3-request-time, request_payload_size
metric_value	number	Metric value. Units vary by metric.	2559.276354, 19698
prompt_id	string	Prompt ID associated with the metric.	UUID

4.6. Score Card Fields

Field	Type	Description	Example Values
id	string	Score card ID, when present.	UUID
prompt_id	string	Prompt ID associated with the score card.	UUID
report_type	string	Portion of the interaction evaluated.	input, output
started_at	string	Evaluation start time, when present.	RFC3339 timestamp
completed_at	string	Evaluation completion time, when present.	RFC3339 timestamp
data_modified	boolean	Whether the data was modified by the evaluation.	true, false
confidence	integer	Confidence score for the evaluation result, when present.	0 to 100
risk_score	integer	Risk score for this score card.	0, 1, 2, 3
risk_type	string	Risk category.	Data Leakage, Prompt Injection, Privacy Violation, None
risk_metric	string	Risk level.	None, Low, Medium, High
message	string	Human-readable evaluation message.	sensitive data detected
result	string	Evaluation result.	pass, fail, blocked
filter_identifier	string	Raw identifier for the guardrail or classifier that produced the result.	llm-manager, fl-pre-topic-categorizer, fl-pre-prompt-safety, svc-pre-fileprocessor
rule_result	string	Rule result, when present.	pass, fail
rule_message	string	Rule message, when present.	matched restricted pattern

4.7. Alert Fields

Field	Type	Description	Example Values
id	string	Alert ID.	string
metadata	object	Alert metadata. Shape varies by alert type.	{ “risk_metric”: “High” }
created	string	Alert creation time, when present.	RFC3339 timestamp
updated	string	Alert update time, when present.	RFC3339 timestamp

5. Audit Payload

Audit events are delivered under event.audit.

Field	Type	Description	Example Values
id	string	Audit event ID.	UUID
initiated_by_type	string	Actor type.	user, access_token
initiated_by_id	string	Actor ID, when available.	UUID
auth	object	Authenticated actor details, when available.	See Audit Auth Fields
record_name	string	Entity or record type.	policy, user, groups, app-catalog, stringlists
record_alias	string	Human-readable record name, when present.	Global AI Policy
record_id	string	Entity or record ID.	string
action	string	Action performed.	create, update, delete, login, clickthrough_accept, clickthrough_decline
status	string	Action status.	success, failure, error
created_at	string	Audit event creation time.	RFC3339 timestamp
updated_at	string	Audit event update time.	RFC3339 timestamp
metadata	object	Audit metadata.	See Audit Metadata Fields

5.1. Audit Auth Fields

Field	Type	Description	Example Values
identifier	string	Unique actor identifier.	string
email	string	Actor email, when present.	user@example.com
first_name	string	Actor first name, when present.	Jane
last_name	string	Actor last name, when present.	Doe
username	string	Actor username, when present.	jane.doe
token_id	string	Token ID, when present.	string
token_type	string	Token type.	user, access_token
roles	array	Actor roles, when present.	[ ]

5.2. Audit Metadata Fields

Field	Type	Description	Example Values
title	string	Audit event title.	Policy updated
changes	array	Structured list of changes.	[ ]
old	object	Previous record value, when present.	{}
new	object	New record value, when present.	{}
record	object	Record snapshot, when present.	{}

metadata.changes[] entries may include:

Field	Type	Description	Example Values
old	object	Previous field value.	{ “value”: null }
new	object	New field value.	{ “value”: “Updated value” }
path	string	Changed field path.	policy.name
label	string	Human-readable field label.	Policy Name added

6. Forwarding Configuration Effects

The customer-controlled SIEM configuration determines which payload fields are present.

Setting	Effect On SIEM Payload
Prompt events enabled	Prompt payloads are forwarded.
Alert events enabled	Prompt payloads with alert/risk information are forwarded.
Audit events enabled	Audit payloads are forwarded.
Include sanitized prompt field	Controls whether sanitized can appear.
Include original/desanitized prompt fields	Controls whether input and desanitized can appear.
Include LLM output field	Controls whether llm_output can appear.
JSON lines enabled	Sends one event envelope per line instead of a JSON array.

7. Example Prompt Event

The SIEM envelope contains event.prompt as a JSON-encoded string.


{
    "time": 1716400000,
    "host": "witness-host",
    "source": "witness-source",
    "sourcetype": "json",
    "index": "main",
    "event": {
        "prompt": "<stringified prompt JSON>"
    },
    "fields": {
        "request_id": "00000000-0000-0000-0000-000000000001"
    }
}

After parsing event.prompt, a prompt payload can look like this. Alert-enabled prompt events use the same shape; alertspecific details appear in score_cards and, when present, alerts.


{
    "id": "00000000-0000-0000-0000-000000000001",
    "conversation_id": "00000000-0000-0000-0000-000000000002",
    "action": "allowed",
    "input": "Number of colors in the rainbow?",
    "sanitized": "Number of colors in the rainbow?",
    "llm_output": "There are seven colors in the rainbow: red, orange, yellow, green, blue, indigo, and
violet.",
    "desanitized": "There are seven colors in the rainbow: red, orange, yellow, green, blue, indigo, and
violet.",
    "source": "client",
    "application_name": "witness-client",
    "filter_output": {
        "topic": "Education & Learning",
        "subtopic": "Science Facts",
        "intent": "Learn about rainbow colors"
    },
    "result": "pass",
    "risk_score": 0,
    "input_score": 0,
    "output_score": 0,
    "combined_score": 0,
    "prompt_index": 1,
    "policy_id": "00000000-0000-0000-0000-000000000003",
    "policy_name": "Global AI Policy",
    "policy_version": 1,
    "conversation": {
        "id": "00000000-0000-0000-0000-000000000002",
        "user_id": "00000000-0000-0000-0000-000000000004",
        "user": {
            "id": "00000000-0000-0000-0000-000000000004",
            "email": "user@example.com",
            "user_name": "user"
        }
    },
    "score_cards": [
        {
            "prompt_id": "00000000-0000-0000-0000-000000000001",
            "report_type": "input",
            "data_modified": false,


            "risk_type": "None",
            "risk_metric": "None",
            "result": "pass",
            "filter_identifier": "llm-manager"
        },
        {
            "prompt_id": "00000000-0000-0000-0000-000000000001",
            "report_type": "input",
            "data_modified": false,
            "risk_type": "None",
            "risk_metric": "None",
            "message": "Learn about rainbow colors",
            "result": "pass",
            "filter_identifier": "fl-pre-topic-categorizer"
        }
    ],
    "attachments": [],
    "prompt_metrics": [],
    "tags": []
}

8. Example Attachment Prompt Event

Attachment events use the same event.prompt envelope. Attachment-specific information appears in attachments, prompt_metrics, filter_output, and score_cards.


{
    "time": 1716400000,
    "host": "witness-host",
    "source": "witness-source",
    "sourcetype": "json",
    "index": "main",
    "event": {
        "prompt": "<stringified attachment prompt JSON>"
    },
    "fields": {
        "request_id": "00000000-0000-0000-0000-000000000010"
    }
}

After parsing event.prompt, an attachment prompt payload can look like this:


{
    "id": "00000000-0000-0000-0000-000000000010",
    "conversation_id": "00000000-0000-0000-0000-000000000011",
    "action": "allowed",
    "application_name": "gemini",
    "input": "The file \"example.pdf\" was processed.",
    "sanitized": "The file \"example.pdf\" was processed.",
    "llm_output": "File processing complete",
    "desanitized": "File processing complete",
    "filter_output": {
        "risk_type": "Data Leakage",
        "risk_metric": "Medium"
    },
    "risk_score": 3,
    "input_score": 0,


"output_score": 0,
"combined_score": 0,
"prompt_index": 3,
"policy_id": "00000000-0000-0000-0000-000000000012",
"policy_name": "Observability Policy",
"policy_version": 205,
"conversation": {
    "id": "00000000-0000-0000-0000-000000000011",
    "user_id": "00000000-0000-0000-0000-000000000013",
    "user": {
        "id": "00000000-0000-0000-0000-000000000013",
        "email": "user@example.com",
        "user_name": "user@example.com"
    }
},
"attachments": [
    {
        "file_id": "00000000-0000-0000-0000-000000000014",
        "file_location": "/attachments/gemini/00000000-0000-0000-0000-000000000010/example.pdf",
        "file_name": "example.pdf",
        "file_size": 19698
    }
],
"prompt_metrics": [
    {
        "metric_name": "g3-request-time",
        "metric_value": 2559.276354,
        "prompt_id": "00000000-0000-0000-0000-000000000010"
    },
    {
        "metric_name": "request_payload_size",
        "metric_value": 19698,
        "prompt_id": "00000000-0000-0000-0000-000000000010"
    }
],
"score_cards": [
    {
        "filter_identifier": "svc-pre-file-processor",
        "message": "Attachments processed successfully",
        "report_type": "input",
        "result": "pass",
        "risk_metric": "None",
        "risk_type": "None"
    },
    {
        "filter_identifier": "fl-pre-anonymizer",
        "confidence": 100,
        "data_modified": true,
        "message": "attachments required anonymization",
        "report_type": "input",
        "result": "pass",
        "risk_metric": "Medium",
        "risk_score": 3,
        "risk_type": "Data Leakage",
        "rule_message": "Be careful with sharing sensitive data",
        "rule_result": "warn"
    }
],


    "tags": []
}

9. Example Audit Event

The SIEM envelope contains event.audit as a JSON-encoded string.


{
    "time": 1716400000,
    "host": "witness-host",
    "source": "witness-source",
    "sourcetype": "json",
    "index": "main",
    "event": {
        "audit": "<stringified audit JSON>"
    },
    "fields": {
        "request_id": "00000000-0000-0000-0000-000000000004"
    }
}

After parsing event.audit, an audit payload can look like this:


{
    "id": "00000000-0000-0000-0000-000000000004",
    "initiated_by_type": "access_token",
    "initiated_by_id": "00000000-0000-0000-0000-000000000005",
    "auth": {
        "identifier": "customer-token",
        "roles": [
            "super-admin"
        ],
        "token_id": "00000000-0000-0000-0000-000000000005",
        "token_type": "access_token"
    },
    "record_name": "policy",
    "record_alias": "policy",
    "record_id": "00000000-0000-0000-0000-000000000006",
    "action": "create",
    "status": "success",
    "created_at": "2026-05-18T22:00:00Z",
    "updated_at": "2026-05-18T22:00:00Z",
    "metadata": {
        "title": "Global AI Policy",
        "changes": [
            {
                "path": "policy.name",
                "label": "Policy Name added",
                "old": {
                    "value": null
                },
                "new": {
                    "value": "Global AI Policy"
                }
            }
        ]
    }