OpenTelemetry Export
Overview
The Cerbera AI proxy running on each device can export metrics and logs directly over OTLP, the OpenTelemetry protocol, to a collector or SIEM endpoint you configure. This is the primary way to get AI signals out of Cerbera and into your SIEM, where they can be correlated with the rest of your telemetry and feed your existing detection and response workflows.
Because export happens from the device itself to the endpoint you provide, exporting over an open standard avoids stacking opaque blocking tools on top of one another. You route AI signals to the places where they make sense for you, instead of treating Cerbera as a separate silo.
This reflects the design goal behind Cerbera AI: spend as little time in the app as possible. Telemetry should flow to where your team already works. See Openness & Interoperability.
What Gets Exported
| Signal | Example |
|---|---|
| AI provider requests | A counter of requests per provider, tool, user, and device |
| Rule hits and evaluation duration | Which rule matched, its action, and how long evaluation took |
| Interception latency | Proxy-side timing for the intercepted connection |
| MCP and tool-usage activity | Counters for MCP monitoring and tool invocations, when enabled |
| Alert trace IDs | Each alert carries an OpenTelemetry trace ID so it can be correlated with the request it came from |
See Dashboards & Alerts for the in-app view of the same data, and Privacy for what is and is not included in request bodies.
How It Works
You configure an OTLP endpoint (and any auth headers it needs) for your organization. Cerbera pushes that configuration down to every device, and each device's proxy exports directly to your endpoint, so there is no intermediate hop through Cerbera's own cloud for this data. You can also export to a local file instead of a remote endpoint if that fits your pipeline better.
Provide your endpoint
Share the OTLP endpoint (and any auth headers) for your collector or SIEM with your Cerbera security engineer.
Choose what to export
Decide which signals to stream, and whether request bodies are included. What each record contains for request and response bodies is governed by your privacy settings.
Correlate in your SIEM
AI usage, rule matches, and MCP activity arrive alongside your other telemetry for detection, dashboards, and audit.
Privacy controls apply to exported data exactly as they do in the app. By default, records carry metrics and the fact that a rule matched, not request or response bodies. See Privacy.