Skip to content
Olympusx AIOlympusx AIOlympusx AI documentation

Log sources

A log source is your own OpenSearch or Loki, which an investigation can read: firewall, network and sign-in events. Olympusx AI reads it in place, read-only and only during an investigation, never copies your logs, and keeps nothing but what the investigation found. The Olympusx AI audit log is always a source and needs no setup.

Who can do what

Section titled “Who can do what”
Role What they can do
Admin Add, test and remove log sources; turn their alerts on and off.
Auditor See the log sources, their last test and their alert state.
Builder, End user, Reviewer Do not see log sources.

Before you start

Section titled “Before you start”
  • An address the control plane can reach. Private addresses are fine. Loopback, link-local (including cloud metadata endpoints), unspecified and multicast addresses are refused, and so is a name that resolves to one when Olympusx AI connects. Allow egress from the Olympusx AI namespace to the store if your network policy restricts it; see Network and hardening.
  • An account that can only read. With a username, the secret is a password (basic authentication); without one, it is a bearer token. Leave both empty for a store that needs neither.
  • For OpenSearch: the account can search the index or pattern you name, through /<index>/_search.
  • For Loki: the account can call /loki/api/v1/query_range and /loki/api/v1/query on the streams you select, and the log lines are JSON, so their fields can be read.
  • Field names. Olympusx AI reads a few fields from each event. By default it expects the Elastic Common Schema (ECS) names below; map your own if they differ.

Add a log source

Section titled “Add a log source”
  1. Open Use cases › Security and select the Sources tab. Log sources is at the bottom.
  2. Select Add a log source.
  3. Under Store, choose OpenSearch or Loki.
  4. Enter a Name (at most 80 characters, unique in the tenant).
  5. Enter the Address where the control plane reaches the store, for example https://opensearch.example.internal:9200. It must be an http or https URL with no credentials, query or fragment in it.
  6. Name what to read:
    • OpenSearch: Index or pattern, for example firewall-*.
    • Loki: Stream selector, for example {job="firewall"}.
  7. Enter Username (optional) and Password or token (optional).
  8. Under Field names (ECS unless you change them), change any field your events name differently.
  9. Select Test and add. Olympusx AI reads the store once and keeps the source only if the read succeeds. The secret is sealed and never shown again.

Field names

Section titled “Field names”
Field Console label Default (ECS) Used for
time Time @timestamp The window. Never filtered on directly.
actor Account user.name Who acted
src_ip Source address source.ip Where traffic came from
src_port Source port source.port
dst_ip Destination address destination.ip Where traffic went
dst_port Destination port destination.port
action Action event.action What happened, such as allow or deny
outcome Outcome event.outcome Success or failure
host Reporting host host.name The device that logged it
message Message message The text a query’s phrase is matched against

A mapped name is a dotted JSON path, at most 200 characters. For Loki, Olympusx AI flattens the same paths with underscores, as Loki’s JSON parser names them.

Test, alert or remove

Section titled “Test, alert or remove”

Each row shows the Source, what it Reads, and the Last test: Reached or Failed, with the store’s answer. Its actions:

  • Test reads the store once more and records the answer. OpenSearch answers with the number of events in the index; Loki with the number of streams with events in the last day.
  • Alerts turns on the webhook your Alertmanager or SIEM posts to. See Alert integration.
  • Remove deletes the source. Findings its investigations reported stay.

What Olympusx AI reads

Section titled “What Olympusx AI reads”

During an investigation, every read is one of:

  • a search for events in the window, filtered by exact values of the mapped fields and a phrase in the message, at most 200 events; or
  • a count of the window’s events by one field, or by hour.

Before the first round, Olympusx AI counts the window’s events by action and by outcome, so the model asks for values your store holds. Each answer is read up to 8 MiB. A store that redirects is not followed, so your credentials go nowhere else. Each request waits at most 30 seconds.

When it does not work

Section titled “When it does not work”
Message Cause and fix
that address is not one a log source may have The address is loopback, link-local or resolves to one. Use the store’s routable address.
The test times out The control plane cannot reach the store: check DNS, routing and network policy.
The test answers 401 or 403 The username, password or token is wrong, or the account cannot read the index or streams.
Queries return no events The field names do not match your events. Check the mapping against one of your documents.
Loki events have no fields The log lines are not JSON. Olympusx AI reads Loki lines with a JSON parser.
Section titled “Related”