CISA Logging Reference Architecture · August 2026

What CISA asks for.Caver, read against it section by section.

CISA published the Logging Reference Architecture in August 2026, turning OMB memorandum M-26-14 into architectural decisions agencies have to make. It is not a list of sources to collect. It asks whether your logging capability can be shown to still be working, and it names the failure modes that make a healthy looking estate useless. This page maps Caver to it in CISA's own section numbering, so you can check us against the document rather than against our adjectives.

Request evaluation access →→Read the architecture on cisa.gov

“A logging capability that lacks validation of operational functions cannot be considered reliable.”

LRA §4.7

Most platforms answer “is the data here”. Section 4.7 asks the harder question: how would you know it stopped being here, while everything still looked healthy. That distinction runs through the whole document, and it is the one Caver was built around.

Section by section

CISA's requirement on the left, what Caver does on the right.

4.7

Detect coverage gaps, delivery failures, latency deviations, parser and schema inconsistencies and missing fields, even when systems appear to be functioning as intended.

Gap detection, not dashboards

Every Carbide agent heartbeats on the same channel it ships telemetry on. A host that goes quiet raises heartbeat_missing. One that is reporting but collecting nothing raises heartbeat_empty, which is the case a green dashboard hides. Agent updates roll out in stages, and a version that will not come up puts the previous one back on its own, with nobody logging in.

6.2.5

Endpoint and system activity: device identity, process context, identity context, timestamp and result. Distinguish lightweight host status from the richer context needed for lateral movement analysis and timeline reconstruction.

Kernel level process telemetry

Carbide captures process execution in kernel with eBPF CO-RE, container aware, with parent and child lineage intact. Every event declares its own collection fidelity, so a degraded path is legible instead of silently thinner.

6.3

A reliable timestamp, event type, identity context, affected resource, outcome, and provenance. Time synchronization implemented, monitored and validated for major telemetry sources.

Clocks are watched, not assumed

Caver compares every source's event time against its own receive time and reports the drift per source. A host whose clock has slipped is named, because a drifting clock drops nothing, errors on nothing, and quietly corrupts the timeline an investigation is built on.

6.4

The failure modes CISA names as materially degrading operations: source present without usable detail, retention without searchability, normalized data without recoverable source meaning, unreliable timestamps, and alerting that cannot be validated against high fidelity context.

Measured, not assumed

Each of those is something Caver measures. Coverage is shown with its gaps named. Clock drift is tracked per source. Every firing detection carries the query and the raw events behind it, so an alert can always be checked against what actually arrived.

7.1

Durable normalization, including parent and child execution relationships. Agencies should not rely solely on ephemeral query-time transformations.

Normalization that outlives the query

The raw event is preserved and the normalized class is a durable layer over it, not a transformation applied at read time. Process lineage is part of the contract, so a chain joins across event types rather than only inside one.

7.2

Source-native context preserved for recoverability, so normalization does not destroy what the source actually said.

Raw is never discarded

Normalization adds a layer, it never replaces the original record. Every event carries which normalizer produced its view and which version of it, so the transformation chain is part of the record rather than tribal knowledge.

8.2

Integrity at collection, in transport, in storage and during access. Hashing, signing, immutable handling, auditable transfer paths, and preservation of provenance.

Evidence Locker

Artifacts are hashed on arrival, re-verified on every read, appended to an RFC-6962 Merkle transparency ledger, exported under an Ed25519 signature, and verifiable offline by a third party who does not trust Caver at all. Sealing a case freezes it.

4.5

Separate actively searchable data from lower cost retrievable tiers. Decide how long each dataset stays searchable and which are eligible to move.

Tiers you set per index

Each index declares how long it stays hot, when it becomes retrievable, and what retrieval costs. Tuned and re-measured in the interface rather than set once in a config file and forgotten.

6.2.8

High value assets and specialized environments, including OT and clinical systems, which the baseline categories do not adequately cover.

OT and clinical, first class

Eight industrial protocols parsed to a common operation vocabulary, so a write to a controller reads the same whether it arrived over Modbus or DNP3. Clinical access trails are separated by message class rather than pooled into one number.

3.3

Incident response that lets responders scope accurately and preserve the information needed to justify and document their actions.

Cases, not an alert list

Numbered incidents with the firing context persisted, tasks, observable enrichment, TLP handling and playbooks. The rule, the CVE, the technique and the originating query are one click from the case.

3.4

Digital forensics using records complete enough, preserved long enough, and protected well enough to be trusted. Not only a post-incident legal concern.

Built for the second question

The one after "what happened", which is "can you show me". Signed bundles and an independent verifier instead of testimony about process.

Carbide · the Caver endpoint agent

The sensor, when you need one

Section 6.2.5 asks for endpoint records rich enough for lateral movement analysis and timeline reconstruction, and draws a line between lightweight host status and real event context. Most agencies buy that telemetry from somewhere. Carbide is ours, for the hosts where the options are bad, and it exists so that nothing in the logging path is a vendor we cannot fix.

Kernel level, not a log tail

Process execution captured with eBPF CO-RE, so one binary runs across kernel versions without compiling per host. Container aware, with the cgroup resolved in kernel so identity survives a process that has already exited.

Lineage that actually joins

Parent and child are part of the event contract, not inferred later. A chain follows across event types rather than only inside one, which is what turns a list of executions into a story.

It says when it is blind

Every event declares its own collection fidelity. A degraded path reads as degraded instead of quietly thinner, and a host that reports while collecting nothing raises its own alarm.

Updates that undo themselves

Signed manifests, staged rollout by cohort, and a version that will not come up puts the previous one back without an operator. The rollback runs the same install path as every ordinary update, so it is not a route first tried on the day it is needed.

Bring your own sensors too

Carbide is for the hosts with no good option. Caver ingests CrowdStrike, Defender, Sysmon, syslog and forwarders you already run, and most estates will keep both.

The update channel is the part worth dwelling on, because section 4.7 asks for controlled rollout and rollback and almost nothing ships it. An agent that cannot safely update is an agent that stops being updated, and then it is a fleet of old versions nobody wants to touch.

Where an estate sits on CISA's own scale

Section 11.1 describes three stages. Stage 1 reads as a checklist most estates fail, which is the useful thing about it.

Stage 1

Fragmented

Uneven source coverage. Limited correlation between identity, endpoint and network. No explicit split between searchable and retrievable data. Limited validation of timeliness, completeness or parser health.

Stage 2

Consolidating

Moving from fragmented collection toward an enterprise capability, with coverage improving and validation still partial.

Stage 3

Operated as a security function

Coverage and fidelity validated rather than assumed. Durable normalized representation with source-native context recoverable. Explicit integrity, access and resilience controls.

On retention, which the architecture treats as an architectural decision

Section 4.5 asks how long datasets must stay actively searchable, and which are eligible to move to lower cost retrievable tiers. In practice those are budget questions. Caver's measured storage compression is 48:1 against the same window of raw data, compared with roughly 2:1 for a legacy index. It is mentioned here only because it is what decides whether the answer to “how long” is a year or ninety days.

Bring the document, we will go through it

The most useful version of this conversation is section by section against your estate, including the parts where the answer is that you have work to do.

Start a conversation →Read it on cisa.gov