SIEM Integration
Stream security events to your SIEM platform
Supported SIEMs
- Splunk
- Microsoft Sentinel
- Elastic Security
- Sumo Logic
- Datadog
- Any syslog-compatible SIEM
Configuration
Configure SIEM forwarding in Settings → Integrations → SIEM:
- Select your SIEM platform
- Enter your SIEM endpoint URL
- Configure authentication (API key or certificate)
- Select which event types to forward
- Test the connection
Event Format
{
"event_type": "security_finding",
"severity": "high",
"timestamp": "2024-01-08T12:00:00Z",
"device_id": "dev_abc123",
"finding": {
"id": "find_xyz789",
"title": "Firewall disabled",
"description": "System firewall is not enabled"
}
}