Sources and tokens

Every event belongs to a source: an access token an application sends with, the Syslog listener, Added in the UI (logs pasted or uploaded on the Sources page) or INTERNAL (SIEMLite's own audit log). Each shows when it was last used, so you can see which are active, and each (except INTERNAL) can have a parser, or be set to Automatic or None. A new install also has a Log generator token source for test logs.

Access tokens can only post to /api/v1/logs and /api/v1/events. Choose Manage on a token's row to open a popup with three options:

• Enable: the token is accepted. This is how a new token starts.
• Disable: the token is rejected straight away. The source, its token and its logs are kept, and choosing Enable makes the same token work again.
• Delete: removes the source and its token for good; the token can't be restored. Its logs stay in the Database, shown as "Deleted source". SIEMLite asks again before it deletes, and refuses while an alert rule is scoped to the source (it names the rules; change them first).

The built-in sources can't be disabled or deleted. Each change is recorded in the audit log. From the command line:

./siemlite keys create -name <name>
./siemlite keys list      # with last used times; a disabled token shows "disabled"
./siemlite keys disable -id <id>   # revoke is the same thing
./siemlite keys enable -id <id>
./siemlite keys delete -id <id>

Tokens look like slk_.... Only a SHA-256 hash is stored, so a token is shown once at creation. The keys and users commands work while the server is running. Pass -db if your database is not ./siemlite.db.