Realm.Security Documentation

Appearance

Cloud OTLP Integration ​

Realm exposes an OpenTelemetry Protocol (OTLP) endpoint that OpenTelemetry Collectors, agents, and SDKs can send log records to directly. Each Cloud OTLP input feed gets its own HTTPS endpoint and bearer token, so you can route OTLP logs into Realm without additional middleware.

Note: Cloud OTLP accepts OTLP over HTTP only. gRPC is not supported, so configure your exporter to use OTLP/HTTP (for example, the otlphttp exporter in the OpenTelemetry Collector).

Prerequisites ​

  1. Access to the Realm Security console.
  2. An OpenTelemetry Collector, agent, or SDK that can export logs over OTLP/HTTP and reach Realm Cloud on port 443.

Create a Source in Realm ​

  1. In Realm, go to Sources > Add Source.
  2. Enter a name for your source.
  3. Set Product Format to match the logs being forwarded. Cloud OTLP is available for Custom CEF, Custom CSV, Custom JSON, Custom Syslog, and Jenkins OTLP.
  4. Click Save.

Add a Cloud OTLP Input Feed ​

  1. On the Select Transport Method step in the Add Source flow, or from the source page, click Add Input Feed.
  2. Select Cloud OTLP and give it a name.
  3. Configure the input feed:

    Token: <your token> (optional — leave empty to have Realm generate one)
    TLS Issuer: Public or Realm Private CA

  4. Click Add. Realm displays the connection details for the new input feed.

Note: Use Public unless your OTLP client requires a private trust chain. Clients connecting to a Public endpoint only need up-to-date system CA certificates.

View Connection Details ​

  1. Click ... > View on the Cloud OTLP input feed.
  2. Copy the connection details:

    Hostname: https://<feed-id>.<account-id>.cloud.ingest.realmsec.net
    Port: 443
    Protocol: SSL / TLS

  3. If you selected Realm Private CA, copy the Realm CA pem file and save it to a file on the host running your OTLP client.
  4. Click ... > Edit on the input feed, then click the eye icon in the Token field to reveal the token value.
  5. Copy the Token.

Important: Treat the token as a secret. Anyone with the hostname and token can send data to this input feed.

Configure Your OpenTelemetry Collector ​

Add an otlphttp exporter that points to the Cloud OTLP Hostname and sends the Token as a bearer token in the Authorization header. The otlphttp exporter appends /v1/logs to the endpoint automatically.

yaml
exporters:
  otlphttp/realm:
    endpoint: https://<feed-id>.<account-id>.cloud.ingest.realmsec.net
    headers:
      Authorization: "Bearer ${env:REALM_OTLP_TOKEN}"

service:
  pipelines:
    logs:
      receivers: [<your receivers>]
      processors: [<your processors>]
      exporters: [otlphttp/realm]

Set the REALM_OTLP_TOKEN environment variable for the Collector process instead of writing the token into the config file.

If the input feed uses Realm Private CA, point the exporter at the saved certificate:

yaml
exporters:
  otlphttp/realm:
    endpoint: https://<feed-id>.<account-id>.cloud.ingest.realmsec.net
    headers:
      Authorization: "Bearer ${env:REALM_OTLP_TOKEN}"
    tls:
      ca_file: /path/to/realm-ca.pem

After updating the config, reload or restart your OpenTelemetry Collector to apply the changes.

For a complete example using Cloud OTLP, see the Jenkins OTLP guide.

Troubleshooting ​

Authentication errors (HTTP 401)

  1. Confirm the Authorization header uses the format Bearer <token>.
  2. Ensure there are no leading or trailing spaces in the token value.

Connection or protocol errors

  1. Confirm the exporter uses OTLP/HTTP, not gRPC.
  2. Confirm the endpoint starts with https:// and outbound traffic to port 443 is allowed.

TLS / certificate errors

  1. For Public input feeds, ensure the host has up-to-date CA certificates installed.
  2. For Realm Private CA input feeds, ensure the exporter's ca_file points to the Realm CA pem file copied from the input feed.

Support ​

If you encounter any issues or require assistance, contact Realm Security support.