lumnik. / scenarios All scenarios · Français

A changed bank account the SIEM never sees

Goal Let the SIEM see a supplier's IBAN change, without the IBAN showing in the inbox.

The ERP exports its suppliers as CSV. It emits no event. A bank-account change goes unnoticed until the next payment.

calibration.csv
supplier_id,supplier_name,iban,status
CALIBRATION,Schema calibration,FR7600000000000000000000000,INACTIVE
manifests/20-bank-account-process.yaml
apiVersion: apps.lumnik.io/v1kind: Processmetadata:  name: scenario-siem-bank-account-observed-espec:  scope: supplier-security  on:    event: data.row.changed    table: connector.t_scenario_siem_suppliers_e  when:    - status=ACTIVE  emit:    type: decision.supplier-bank-account-observed-e    message: "Bank account observed for supplier {supplier_id} ({supplier_name})"    # The account goes to the SIEM in the payload, never into the sentence an inbox reader sees (#1365).    fields: [iban]
suppliers-day1.csv
supplier_id,supplier_name,iban,status
SUP-0042,Atelier Orion,FR7630006000011234567890189,ACTIVE
SUP-0077,Transports Aster,FR7612345000098765432100123,ACTIVE
suppliers-day2.csv
supplier_id,supplier_name,iban,status
SUP-0042,Atelier Orion,FR76 3000 6000 0198 7654 3210 458,ACTIVE
SUP-0077,Transports Aster,FR7612345000098765432100123,ACTIVE
SUP-0042
baseline · …0189
SUP-0077
baseline · …0123
SUP-0042
alert · …0458
alert
supplier_bank_account_changed · high · SUP-0042 · …0189 → …0458

evidence: replay.log, 06-run-ledger.json, 08-output-ledger.json, 09-siem-alerts.json, siem-events.jsonl · transform v1

$ lm run list --connector scenario-siem-suppliers-e --limit 20
ID        CONNECTOR                  ENDPOINT  STATUS     IN  OUT  SKIPPED  DEAD-LETTERS  STARTED           ENDED             EVALUATED
1a70afbd  scenario-siem-suppliers-e  default   Completed  2   2    0        0             2026-10-22 07:23  2026-10-22 07:23  yes
11a0b21d  scenario-siem-suppliers-e  default   Completed  2   2    0        0             2026-10-22 07:22  2026-10-22 07:22  yes
cb621230  scenario-siem-suppliers-e  default   Completed  1   1    0        0             2026-10-22 07:21  2026-10-22 07:21  —

$ lm inbox --process scenario-siem-bank-account-observed-e
ID     WHEN      PROCESS                                MESSAGE                                                         ENTITY_KEY
17553  just now  scenario-siem-bank-account-observed-e  Bank account observed for supplier SUP-0042 (Atelier Orion)     a7744b2f8451d76b087014b7b444c24476fbbd2123333a46cd2f28d7571ec7fe
17549  1min      scenario-siem-bank-account-observed-e  Bank account observed for supplier SUP-0077 (Transports Aster)  58f540961dbf9bd161806eb79820c99fb20f123b45d21deec7d64692f8bc8ea6
17548  1min      scenario-siem-bank-account-observed-e  Bank account observed for supplier SUP-0042 (Atelier Orion)     ff679e17955ab06ae141d6d64f706d4cc813ce93b43489f497aa31ba694b3a3e

$ lm connector pause scenario-siem-suppliers-e
paused: scenario-siem-suppliers-e

Limits

  • Process sees a new ingested row. It does not compare it with the previous one: the SIEM correlates, as in production.
  • The full account crosses the signed webhook, for an exact fingerprint. In production: HTTPS, and restricted access to the delivery journal, which keeps payloads.
  • Synthetic SIEM. A real SIEM would apply its own rules.
  • Synthetic data.

Suppliers · ERP

A bank account changes in the ERP. Security does not see it.

The next payment goes to the new account.

The ERP exports its suppliers as CSV. It emits no event.

Fictional suppliers · synthetic data

The problem

A classic fraud goes through the bank account.

  • A supplier's account is changed.
  • No alert leaves the ERP.
  • The SIEM receives nothing.

Nothing is changed

The ERP stays as it is.

  • lumnik rereads the export every minute.
  • It does not write to the ERP.
  • A signed decision goes to the SIEM.

What had to be written

when:
  - status=ACTIVE
emit:
  fields: [iban]

The account goes to the SIEM, not into the sentence.

The whole scenario fits in 2 declaration files, 30 lines.

What the inbox shows

The supplier, never the account.

Decision inbox
Bank account observed for supplier SUP-0042 (Atelier Orion)

Real message, replay of 22 October 2026.

What the SIEM decides

A baseline, then an alert.

  • Day 1: SUP-0042's first account, …0189.
  • Day 2: …0458. High alert.
  • SUP-0077 unchanged: nothing.

SIEM keeps: fingerprint, last 4 digits.

The limit

lumnik carries. The SIEM correlates.

  • lumnik sees a new row.
  • It does not compare it with the old one.
  • The SIEM decides the account changed.

Try it

The scenario replays end to end.

Export, schedule, webhook, SIEM: each step is published with its output.

This scenario runs on lumnik Open, free and open source.

Try lumnik Open →