# SIEM and alerts are not arriving

## Push delivery stopped

**SIEM Export** shows delivered count, last success, last attempt and **last error**. Start
there — it usually names the cause: an expired certificate, a moved collector, a closed
port.

The status badge reads **Active** or **Paused**.

## Push was never configured correctly

Private and internal hostnames are rejected — the collector must be reachable from
Sentilai, so a `10.x` address will not work. Either publish the collector on a name we can
reach, or use the pull API from inside your network.

**Send test event** delivers a `siem_push_test`. If that does not arrive, nothing else
will.

## Pull returns nothing

Check the credential has **`audit:read`**, has not expired, and is not blocked by its own
IP allowlist. The **Last used** column on API Credentials tells you whether your calls are
arriving at all.

Check you are passing the **cursor** back. Without it you re-read the same page forever.

## Alerts stopped arriving

Alerts are **fire-and-forget** — delivery is attempted alongside the request and never
blocks it, which means an alert can be lost if the destination is briefly unreachable.

Use **Send test** on the channel. If the test arrives and real alerts do not, check the
channel's **minimum severity**: "High only" will stay silent through a great deal of
genuine medium-severity activity.

If you need guaranteed delivery of every event, that is the SIEM path, not alerts.