SIEM

Export events to an external security system.

Export events to an external security system.

This screen belongs to the Secure deployment operator, not an ordinary hosted customer. Hosted customers have a separate account page with their own keys and limits; policy and service settings are not exposed there. Contact the operator to change protection. In the operator console, open the route listed above; a report tenant filter does not automatically scope a global setting.

Examples use educational data. Use your own authorized tenant in real integrations. Each screenshot shows the actual frontend, with the source and educational/demo mode stated below it.

Step-by-step actions

  1. SIEM → Endpoint URL: enter an approved endpoint.
  2. Choose JSON/CEF/LEEF and enable SIEM export.
  3. Save and reread configuration.
  4. Test delivery, then locate the synthetic event in SIEM and verify parser/event ID.
  5. Disable and Save to stop export. Restore prior endpoint/format/enabled to revert.

Every control and its meaning

Control / parameterValues, units and effect
Endpoint URLApproved HTTP/HTTPS receiver endpoint, without query tokens. Operator configures receiver auth through IAM_SEC_SIEM_WEBHOOK_AUTH.
Формат событий / Formatjson / cef (ArcSight) / leef (QRadar). Choose a format supported by the SIEM parser.
Включить SIEM экспорт / enabledEnables export. Disable and save to stop SIEM delivery while local inspection/audit continue.
events_sent / last_sent / last_errorRuntime send/attempt status; verify receipt in SIEM. Test delivery uses saved configuration.

Verify the result

Verify returned enabled, receiver events and last_error. Save without a test does not prove delivery.

Errors, disabling and reverting changes

For 400/422, correct URL/format; for timeout/401, the operator checks networking/auth. Disabling SIEM neither repairs inspection nor deletes history.

SIEM configuration without receiver credentials · actual staging
SIEM configuration without receiver credentials · actual staging
2026-10-15 · Actual staging application and an existing operator session. Synthetic data or non-personal configuration only; credentials and the operator profile are excluded. A form alone does not establish persistence or replica consistency.
  1. Enable export
  2. Endpoint URL
  3. Format
  4. Save

Detailed security settings · Traffic analysis · FAQ · All application sections