Certificate Transparency logs record every publicly-trusted certificate the moment it is issued. The CT log firehose surfaces those entries in real time inside TigerTrust so your security team can watch for unexpected issuances for your domains — unauthorized wildcards, mis-issued certificates, or shadow IT — without polling a separate service.

​
What it is

The firehose is a live stream of CT log entries that TigerTrust has collected for your monitored domains. You can filter by domain substring or issuer and request a historical warm-up from a given point in time, so the stream appears contiguous even if you connect mid-session. The stream is available from the CT Monitoring page in the dashboard and also as a machine-readable event stream for integration with your SIEM or alerting pipeline.

​
When to use it

  • Monitor for certificates unexpectedly issued for your domain by an unauthorized CA.
  • Stream CT entries into a SIEM to correlate new certificate issuances with deployment events.
  • Confirm that a freshly issued certificate has been logged to CT before trusting it in production.
  • Watch for wildcard certificates appearing in CT logs for domains you have not issued wildcards for.
  • Audit issuance frequency for a specific subdomain over a rolling time window.

​
Set it up

1

Open CT Monitoring

Go to Security > CT Monitoring from the main navigation.
2

Type a domain filter

In the live feed panel, enter a domain substring in the Domain field. The feed immediately narrows to entries whose Common Name or SANs contain that substring.
3

Optionally filter by issuer

Enter an issuer name substring in the Issuer field to further narrow the feed — for example, to watch only entries from a specific CA.
4

Scroll back in time

Use the Since date picker to request a historical warm-up. TigerTrust replays entries from that point before switching to the live feed, giving you a continuous view.

​
What you’ll see

The CT Monitoring live feed panel shows a scrolling list of CT log entries with the Common Name, issuer, and entry timestamp. New entries appear at the top without a page refresh. The panel shows a Connected indicator when the live stream is active and a Reconnecting indicator if the connection drops and recovers automatically.
The firehose reflects entries collected by TigerTrust’s CT monitoring on its scan cadence. It is not a direct tap of the raw CT log network — entries appear after TigerTrust has ingested them. For the most time-sensitive monitoring, configure alert rules to fire on ct.misissuance events.

​
Tips

  • Pair the CT firehose with Monitoring > Alert rules using the ct.misissuance alert type to get notified immediately when a suspicious entry is detected, rather than watching the feed manually.
  • The event stream is accessible via the API for SIEM integration. Full spec at API Reference.

CT Monitoring

Full CT monitoring — monitors, mis-issuance detection, and reporting.

Alert Rules

Create alerts on CT mis-issuance events detected in the firehose.