Evidence Format

Public fields for SIEM integration and log analysis.

Docs / Evidence Format

Evidence Format

When PandoCore detects anomalous behavior, it emits a structured JSON record. This page documents the public fields your SIEM or incident pipeline can rely on.

Stable vs. internal fields

Evidence envelopes may contain additional fields that are internal to PandoCore's detection engine. These are not documented here and may change between releases without notice. Build your integrations against the fields listed on this page only.

Delivery Channels

Channel Format
Evidence Webhook HTTP POST of Evidence JSON to PANDO_EVIDENCE_WEBHOOK_URL
stdout One JSON record per line
Kubernetes Event K8s Event object, survives pod deletion
Slack Formatted message to PANDO_SLACK_WEBHOOK_URL

Webhook Headers

Header Description
Content-Type application/json
X-Pando-Evidence-ID UUID of the evidence record
X-Pando-Event-Type Event type, currently collapse
X-Pando-Schema-Version Schema version of the payload

Delivery is retried with exponential backoff (tunable via PANDO_EVIDENCE_WEBHOOK_MAX_RETRIES and PANDO_EVIDENCE_WEBHOOK_TIMEOUT_SECONDS). Evidence is always delivered before pod termination so downstream systems see the record even if the pod is killed.

JSON Example

{
  "version": "2.0",
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2026-03-16T14:30:00.123Z",
  "pod": {
    "name": "my-app-7d4f9b8c5-x2kl9",
    "namespace": "production",
    "uid": "f3b2c1d4-...",
    "node": "gke-cluster-pool-1-abc123"
  },
  "trip_reason": "drift_threshold_exceeded",
  "action_taken": "pod_terminated",
  "response_chain": [
    { "action": "alert",     "success": true, "timestamp": "2026-03-16T14:30:00.150Z" },
    { "action": "isolate",   "success": true, "timestamp": "2026-03-16T14:30:00.320Z" },
    { "action": "terminate", "success": true, "timestamp": "2026-03-16T14:32:00.400Z" }
  ],
  "hash": "a1b2c3d4e5f6...",
  "previous_hash": "9f8e7d6c5b4a...",
  "sequence": 42,
  "metadata": {
    "sidecar_version": "0.5.2",
    "mode": "enforce",
    "customer_id": "cust_abc123"
  }
}

Field Reference

Top-Level

Field Type Description
version string Schema version of the payload.
id UUID Unique evidence record ID.
timestamp ISO 8601 When the detection occurred.
trip_reason string Short machine-readable label for the detection category (e.g., drift_threshold_exceeded, integrity_violation, deadman_timeout).
action_taken string The final action: logged_only, alert_sent, pod_isolated, or pod_terminated.
hash string SHA-256 hash of this record. Used for the tamper-evident chain.
previous_hash string Hash of the previous record in the chain.
sequence integer Monotonically increasing record counter.

pod

Field Description
pod.name Full pod name.
pod.namespace Kubernetes namespace.
pod.uid Pod UID, when available.
pod.node Node the pod was scheduled on, when available.

response_chain

Array of response actions attempted, in order. Each entry records whether the action succeeded and when it ran. In graduated response, earlier actions (e.g. alert, isolate) may succeed before a later action (terminate) is escalated.

Field Description
action alert, isolate, or terminate
success Whether the action completed successfully
timestamp ISO 8601 timestamp when the action ran

metadata

Field Description
metadata.sidecar_version Version string of the sidecar that emitted the record.
metadata.mode Operating mode at the time: monitor, alert, or enforce.
metadata.customer_id Your customer identifier, derived from the license.

Tamper-evident chain

Evidence records form a SHA-256 hash chain. Each record's previous_hash links to the prior record, producing an audit log that downstream consumers can verify for tampering.

Slack Alerts

When PANDO_SLACK_WEBHOOK_URL is set and the mode is alert or enforce, PandoCore sends formatted messages color-coded by severity.

Severity Trigger
Critical Pod was terminated (enforce mode)
High Significant anomaly detected
Warning Detection below enforcement threshold
Info Low-severity detection

Kubernetes Events

# View PandoCore events
kubectl get events -n YOUR_NAMESPACE --field-selector reason=PandoCollapse

Next Steps