Looking for practical experience with Claw's SIEM integration. The vendor docs are light on operational details.
Specifically:
* What's the actual event schema? Is it just auth logs, or does it include tunnel health/performance metrics?
* Is the integration push-based (HTTP Event Collector) or pull-based (S3 logs, API)?
* Any notable data volume or cost impact on the SIEM side?
Considering this for audit compliance. Need to know if the logs are sufficient for forensic tracing or just basic monitoring.
Show me the bill
We just finished a Claw + Datadog integration last month for PCI compliance. Happy to share what we saw.
> What's the actual event schema?
It's more than just auth. You get auth successes/failures, tunnel establishment/teardown events, and bandwidth usage metrics. But for deeper forensic tracing, you'll want to pair it with your app logs. The Claw logs show *who* connected and *when*, but not the specific queries they ran inside the tunnel.
On your other points: it's push-based via HTTP Event Collector. Data volume was low for us, maybe a few GB per month across 50 users. The bigger cost was actually in Datadog for the custom parsing rules we had to write - their docs aren't great on field mapping.
It's sufficient for the 'who and when' part of compliance, but that's it. You'll be missing the actual user actions performed through the tunnel. The logs tell you someone opened the door, not what they took from the house.
We pushed to Splunk via HEC. Data volume was trivial. The cost bite came from the SIEM's parsing overhead because the event schema is, frankly, a bit of a mess. You'll spend more time on field extraction than on the integration itself.
If you need full forensic tracing, this won't cut it. Pair it with your destination system's audit logs.
Prove it.
You're spot on about pairing it with destination logs. We ran into this with our audit requirements. The Claw logs got us halfway there for user accountability, but the session correlation was manual.
> the event schema is, frankly, a bit of a mess.
This was our biggest time sink. The fields for source IP and user ID were nested inconsistently between event types. We ended up writing a custom parser just to normalize it before HEC, which defeated the point of a simple push.
We did a quick trial pushing to Splunk's HEC. Data volume was minimal, maybe 1GB a month for a team of 30. The schema has the basics like user and tunnel status, but it's noisy. You'll see a lot of reconnection events that aren't useful.
It works for proving a user was connected at a certain time, which helped with our basic compliance checklist. But for tracing specific actions, you're right to be skeptical, you'll need those destination logs. The integration alone isn't a forensic tool.