Integrations

Reads what your vehicles
already write.

PX4 ULog, systemd journal exports, MAVLink receive records, process samples and flight test recordings, pulled read-only from the storage you run today. Findings leave only where you send them.

  • Read-only everywhere
  • No agent required
  • Works air-gapped

01 Flight logs

PX4 ULog, topic by topic.

Foxborne reads completed .ulg files: vehicle status, position, battery, GPS, telemetry, logged messages and dropouts. It tells you which expected topics a flight never logged, before anyone goes looking for them.

14_13_19.ulgExample incident INC-0142
  • vehicle_statusPresent
  • vehicle_land_detectedPresent
  • sensor_gpsPresent
  • vehicle_global_positionPresent
  • battery_statusPresent
  • failsafe_flagsPresent
  • telemetry_statusPresent
  • obstacle_distancePresent
  • estimator_statusPresent
  • cpuloadPresent
  • logged messagesPresent
  • distance_sensorNot logged
  • vehicle_imu_statusNot logged

02 Companion computer

The journal, with all three of its clocks.

journalctl JSON exports keep the wall time, the time since boot and the boot ID, so a clock step on the companion never reorders its own events. The optional collector adds process memory, CPU and restarts, with clock status on every sample.

uas04-orin-journal.jsonLine 18,314. Cursor i=5014
{
  "__REALTIME_TIMESTAMP": "1790260324118000",Wall time, µs since the epoch
  "__MONOTONIC_TIMESTAMP": "1152904000",µs since this boot
  "_BOOT_ID": "9b2e4c1d0f8a4e57b3c2a1d9e8f7c6b5",Which boot
  "_HOSTNAME": "uas04-orin",
  "PRIORITY": "3",
  "SYSLOG_IDENTIFIER": "kernel",
  "_TRANSPORT": "kernel",
  "MESSAGE": "Out of memory: Killed process 2213 (perception_node) total-vm:11873248kB, anon-rss:6823516kB, file-rss:10240kB, shmem-rss:0kB, UID:1001 pgtables:14720kB oom_score_adj:0"
}

Read together: the kernel logged this at 2026-09-24 14:32:04.118 UTC, 1,152.904000 s after the companion booted, in boot 9b2e4c1d…. The collector’s samples carry the same boot ID, so their monotonic times line up with the journal’s without trusting either wall clock.

03 Ground station

What range control heard, and when.

Receiver records name the MAVLink message, the system that sent it and the moment it arrived on the receiver’s clock. A gap in them proves only that nothing arrived, and Foxborne says exactly that.

14:32:0014:32:0214:32:0414:32:0614:32:0814:32:1014:32:12Nothing received for 6.96 s
rc1-receive.jsonlHEARTBEAT from system 4, one tick per receipt

04 Flight test

Chapter 10 recordings, channel by channel.

For jet-powered UAS on a test range, Foxborne reads the onboard recorder through its own TMATS setup record, next to the ground station recording, the receiver log, radar TSPI and the flight termination console log.

See the jet example

Data typeChannelIn the jet example
0x01Computer-generated, format 1 (TMATS)The setup record: channel map, PCM format, bus and label definitions
0x11Time, format 1IRIG-B from the airborne GPS time code generator, locked to external time
0x09PCM, format 1The telemetry stream, including the flight termination monitor words
0x19MIL-STD-1553, format 1Flight control computer, EGI, C2 modem and actuator controllers
0x38ARINC 429, format 0Engine control unit: N1, EGT and fuel flow
0x68Ethernet, format 0C2 modem diagnostics at 10 Hz: signal strength, CRC errors, frame counter

05 Storage

Pulls from the storage you already run.

Read-only credentials everywhere: an IAM role, a managed identity, a viewer service account or a read-only mount. Nothing has to move before you start.

ConnectorsRead-only
Amazon S3Including AWS GovCloud, through a read-only IAM role.
S3-compatible storageMinIO, Ceph or any S3 API inside your network.
Azure Blob StorageIncluding Azure Government, through a managed identity.
Google Cloud StorageThrough a service account with the viewer role.
SFTPGround stations and log servers, polled on a schedule.
SMB or NFSNetwork shares mounted read-only on the worker.
Companion collectorA read-only service on each companion computer.
MAVLink receiverRecords every receipt on the ground with its own clock.
Ingest APITest rigs and pipelines push signed bundles.
Manual uploadDrop files into the console. Hashed in the browser first.

06 Alerts and automations

Alerts when a rule fires. Automations when a sortie lands.

Alerts route a finding to the people who need it, carrying only the data class you allow. Automations run the routine work after every sortie, and stop for a named approver before anything leaves.

AlertDefault conditionSeverity and routing
R1Vibration above thresholdaccel_vibration_metric above 24 m/s² for 1.0 s while armed, on the tracked ground robot profileWarning, High if the IMU clips
R2Telemetry gapMore than 3.0 s between heartbeats from the vehicle’s system ID while armedMedium, High once the gap reaches COM_DL_LOSS_T
R3Failsafe enteredvehicle_status.failsafe goes true while armed, with the cause from failsafe_flagsHigh: opens a case and a ticket
R4Memory pressureA process at or above 6,144 MiB RSS for 3 samples, critical on a kernel OOM killWarning, then Critical
R5Device disconnectA registered USB device or CAN interface disconnects or goes bus-off while armedHigh for flight-critical devices
R6GNSS jammingjamming_state 3 for 2 s, or jamming_indicator at 80 or above for 5 sHigh, routed to range safety
A1Sortie closeout triage

When every source on the test card has arrived, Foxborne verifies the manifest, aligns the clocks and runs the rules. A high finding opens a case and a ticket.

A2Failsafe evidence pack

An unplanned failsafe freezes 120 s either side across every source and drafts a marked case file. Nothing leaves until a named approver signs off.

A3Repeat hardware fault

The same device failing on 3 of a vehicle’s last 10 sorties opens a maintenance ticket and flags the vehicle for inspection.

A4Case closure and retention

An approved case becomes a BagIt bundle on write-once storage, with its manifest hash recorded in the ticket and the audit log.

07 Notify, ticket and forward

Sends only what you allow, where you allow it.

Every destination starts disabled. An administrator turns each one on with a host allowlist, credentials and a data class, and every delivery lands in a ledger you can forward to your SIEM.

L0Metadata

Rule, severity, vehicle alias, UTC time and a link back into Foxborne. The default for anything outside the enclave.

L1Summary

The finding with its values. Treated as CUI, and sent only to destinations your program has authorized for it.

L2Evidence

Files and excerpts. They move only through Export, after a named approver signs off.

Notify

  • EmailSMTP relay, STARTTLS on 587 or TLS on 465Works air-gapped
  • MattermostIncoming webhook or bot tokenWorks air-gapped
  • Signed webhookHTTPS JSON, HMAC-SHA256, optional mutual TLSWorks air-gapped
  • AlertmanagerAlertmanager API v2Works air-gapped
  • Microsoft Teams, GCC High and DoDTeams bot or Microsoft GraphNeeds a gov cloud path
  • GovSlackWebhook or Web APINeeds a gov cloud path
  • PagerDutyEvents API v2, metadata onlyNeeds a gov cloud path
  • Amazon SNS in GovCloudSNS Publish with an IAM roleNeeds a gov cloud path

Ticketing

  • Jira Data CenterREST, personal access tokenWorks air-gapped
  • GitLab self-managedIssues API or alert endpointWorks air-gapped
  • Jira in Atlassian Government CloudREST, OAuth 2.0Needs a gov cloud path
  • ServiceNowTable API or Event ManagementNeeds a gov cloud path

Forward logs

  • Syslog over TLSRFC 5424 on RFC 5425, mutual X.509Works air-gapped
  • Splunk HECHTTPS JSON with acknowledgementWorks air-gapped
  • Elasticsearch or OpenSearchBulk API, API key or mutual TLSWorks air-gapped
  • KafkaMutual TLS or SASL, with ACLsWorks air-gapped
  • OpenTelemetry collectorOTLP over HTTPWorks air-gapped
  • Microsoft SentinelLogs Ingestion APINeeds a gov cloud path
  • Amazon SQS or EventBridgeIAM roleNeeds a gov cloud path
  • Every destination starts disabled. An administrator enables it with a host allowlist, credentials and a data class.
  • Markings travel with the content. Summaries and evidence carry your program’s banner.
  • No program or vehicle names in cloud resource names, tags or subjects.
  • Every delivery lands in a ledger with its destination, data class, payload SHA-256 and response.
  • At-least-once delivery with idempotency keys, backoff, a dead-letter queue and replay.

08 Export

Take the evidence with you, intact.

Exports carry hashes and manifests, so whoever receives them can prove nothing changed on the way. Evidence exports wait for a named approver.

PDF case file with CUI markingsThe report, with CUI in the banner and footer of every page and the designation indicator on the first.
BagIt evidence bundleAn RFC 8493 bag with SHA-256 and SHA-512 manifests and the case metadata in bag-info.txt.
Original files with SHA-256 manifestByte-identical originals and a sha256sum-style manifest, checked again on export.
MCAPThe aligned timeline for Foxglove and ROS 2 tools, with the case ID and source SHA-256s in its metadata.
Apache ParquetOne table per signal family, UTC timestamps in microseconds, for fleet analytics.
CSV and JSONLCSV for spreadsheets and scripts, JSON Lines for SIEM and stream loaders.
MATLAB .mat v7.3HDF5-based, for flight-test engineers’ MATLAB and Simulink tools.

Recording something we have not listed? Tell us what your vehicles write and we will say plainly whether Foxborne reads it today.

A pilot on your own data

Bring your hardest incident.

Send one failure you have already investigated. We rebuild it on your data, beside your current tools, and show where the evidence agrees with your conclusion and where it doesn’t.

  1. 1
    Send one incidentA failure you have already investigated, with the flight log and whatever companion or ground evidence you kept.
  2. 2
    We reconstruct itBeside your current tools, on your data, with every claim traced to its source.
  3. 3
    Compare the answersWhere the evidence agrees with your conclusion, where it does not, and what it cannot decide.