Collectors
Point your existing security telemetry at Rokkhe.
A collector is a registered source that sends events to Rokkhe. Registration is explicit: a source exists as a record with its own type, health, and failure queue, so an ingest path can never appear from nowhere.
#Registering a source
bashcurl -X POST https://your.rokkhe/api/events/sources \
-H 'authorization: Bearer <token>' \
-H 'content-type: application/json' \
-d '{"type": "splunk", "name": "prod-es"}'GET /api/events/source-types lists what the deployment accepts. Each source belongs to a workspace, and every event it sends inherits that boundary.
#Sending events
| Endpoint | Use |
|---|---|
| POST /api/events/ingest | A single event. |
| POST /api/events/ingest/batch | Many events in one request. Prefer this for anything high-volume. |
| POST /api/events/sources/{id}/backfills | Replay a historical window through the same path as live traffic. |
Native adapters normalize each vendor’s payload rather than flattening it, so a Splunk notable, a Sentinel incident, and a CrowdStrike detection keep their own fields while becoming comparable.
#When ingestion fails
Rejected events are not dropped. They go to the source’s dead-letter queue with the reason attached, and can be retried once the cause is fixed.
| Endpoint | Use |
|---|---|
| GET /api/events/sources/{id}/status | Health and last-seen for one source. |
| GET /api/events/sources/{id}/dlq | What failed, and why. |
| POST /api/events/sources/{id}/dlq/{failure_id}/retry | Replay one failure after fixing it. |
| GET /api/events/quarantine | Events held back rather than rejected outright. |
| GET /api/events/ingest-telemetry | Throughput and rejection counts across sources. |
A source that stops sending shows in its status rather than simply disappearing from the queue. Silence is a state you can alert on, not an absence you have to notice.