ingestion-api, claude-analyzer, billing and reports

APIs: Ingestion, Analysis, Billing and Reports

ingestion-api

Base URL: http://ingestion-api.secusiem-system.svc.cluster.local:8000

POST /loki/api/v1/push

Loki-compatible endpoint for log ingestion.

Headers:

Authorization: Bearer sk_live_xxx (tenant API key)
Content-Type: application/json

Body (Loki format):

{
  "streams": [
    {
      "stream": {
        "job": "myapp",
        "level": "error",
        "app": "api"
      },
      "values": [
        ["1738000000000000000", "Failed login attempt from 192.168.1.100"],
        ["1738000001000000000", "SQL injection detected in query parameter"]
      ]
    }
  ]
}

Response (204): No content (success)

Internal flow:

Bearer token validation
tenant_id extraction from API key
Forward to Loki with X-Scope-OrgID: tenant-{slug} header
Return 204 on success, 503 if Loki is unavailable

GET /health

{"status": "healthy", "service": "ingestion-api"}

GET /ready

Verifies Loki connectivity.

{"status": "ready", "service": "ingestion-api", "loki": "ready"}

claude-analyzer

Base URL: http://claude-analyzer.secusiem-system.svc.cluster.local:8000

POST /api/v1/analyze

Analyze logs with Claude AI.

Body:

{
  "logs": [
    "Failed password for admin from 192.168.1.100 port 22 ssh2",
    "Failed password for admin from 192.168.1.100 port 22 ssh2",
    "Failed password for root from 10.0.0.5 port 443"
  ],
  "tenant_id": "tenant-acme"
}

Response:

{
  "tenant_id": "tenant-acme",
  "analyzed_at": "2026-02-14T12:00:00",
  "log_count": 3,
  "rule_matches": [
    {
      "rule_id": "brute-force-ssh",
      "rule_name": "SSH Brute Force Attack",
      "severity": "high",
      "mitre_tactic": "TA0006",
      "mitre_technique": "T1110"
    }
  ],
  "claude_analysis": "Multiple SSH brute force attempts detected...",
  "threat_level": "high"
}

Analysis pipeline:

Regex preprocessing (10 MITRE ATT&CK rules)
Context sent to Claude API (Sonnet 4.5 by default)
Threat level extraction from response
Results returned with rule_matches and claude_analysis

GET /api/v1/rules

Returns the 10 pre-configured detection rules.

billing-service

Base URL: http://billing-service.secusiem-system.svc.cluster.local:8000

POST /webhooks/stripe

Receive Stripe webhooks (subscriptions, invoices).

GET /api/v1/usage/{tenant_id}

Calculate current usage for a tenant.

Response:

{
  "tenant_id": "tenant-acme",
  "logs_ingested_mb": 1024.5,
  "logs_stored_gb": 15.3,
  "alerts_generated": 42,
  "estimated_cost_usd": 89.50
}

report-generator

Base URL: http://report-generator.secusiem-system.svc.cluster.local:8000

POST /api/v1/reports/{tenant_id}?report_type=monthly

Generate a security report.

Parameters: report_type = daily, weekly, monthly, custom

Response:

{
  "status": "generating",
  "tenant_id": "tenant-acme",
  "report_type": "monthly",
  "download_url": null
}

Once generated, the download_url will contain a pre-signed S3 URL to download the PDF report.

ingestion-api, claude-analyzer, billing and reports

On this page