xaidr

The xaidr Technology Add-on makes xaidr agent-security telemetry searchable in Splunk. xaidr is an open source runtime security sensor that runs inside an AI agent process and inspects model input, tool calls, model output, and agent-to-agent messages. The add-on defines two sourcetypes and their search-time field extractions: xaidr:json for the native nested JSON shape, and xaidr:openA2A for the flat dotted OpenTelemetry attributes under gen_ai.security.*. Both are normalized onto a common xaidr_* field namespace, so a search written once works against either format. It handles two record types. Scan events carry a verdict on a message, with an action, score, category, and the rules that fired. Circuit breaker events carry a state transition of the sensor, with a transition, reason, counts, and thresholds. The two are distinguished by xaidr_event_type. This is a configuration-only package. It contains no executables, modular inputs, custom search commands, or network-facing code. It targets xaidr telemetry schema version 0.2.0 and expects line-delimited JSON.