Collectors
Point your existing security telemetry at Rokkhe.
A collector is a registered source that sends events to Rokkhe. Registration is explicit: a source exists as a record with its own type, health, and failure queue.
Which sources are supported?
Each source type below has a native adapter that maps the vendor's payload into Rokkhe's alert shape. Register the source with one of its type values.
| Source | Type values |
|---|---|
| Splunk | splunk, splunk_es |
| Elastic | elastic, elasticsearch, elk, kibana, filebeat, ecs |
| Microsoft Sentinel | sentinel, microsoft_sentinel, azure_sentinel, defender |
| CrowdStrike Falcon | crowdstrike, falcon |
| OCSF and Amazon Security Lake | ocsf, security_lake |
| AWS Security Hub | aws_security_hub, securityhub, asff |
| Amazon GuardDuty | aws_guardduty, guardduty |
| Google Security Command Center | google_scc, gcp_scc, scc |
| Wazuh | wazuh |
| Syslog | syslog, rsyslog |
Registering a source
bashcurl -X POST https://your.rokkhe/api/alerts/sources \
-H 'authorization: Bearer <token>' \
-H 'content-type: application/json' \
-d '{"type": "splunk", "name": "prod-es"}'GET /api/alerts/source-types lists what the deployment accepts. Each source belongs to a workspace, and every event it sends inherits that boundary.
Sending events
| Endpoint | Use |
|---|---|
| POST /api/alerts/ingest | A single event. |
| POST /api/alerts/ingest/batch | Many events in one request. Prefer this for anything high-volume. |
| POST /api/alerts/sources/{id}/backfills | Replay a historical window through the same path as live traffic. |
Native adapters normalize each vendor’s payload rather than flattening it, so a Splunk notable, a Sentinel incident, and a CrowdStrike detection keep their own fields while becoming comparable.
When ingestion fails
Rejected events are not dropped. They go to the source’s dead-letter queue with the reason attached, and can be retried once the cause is fixed.
| Endpoint | Use |
|---|---|
| GET /api/alerts/sources/{id}/status | Health and last-seen for one source. |
| GET /api/alerts/sources/{id}/dlq | What failed, and why. |
| POST /api/alerts/sources/{id}/dlq/{failure_id}/retry | Replay one failure after fixing it. |
| GET /api/alerts/quarantine | Events held back rather than rejected outright. |
| GET /api/alerts/ingest-telemetry | Throughput and rejection counts across sources. |
A source that stops sending shows in its status rather than simply disappearing from the queue. Silence is a state you can alert on, not an absence you have to notice.