SIEM export

Pro This feature is available from the Pro edition.

The audit log goes to up to three targets continuously, as entries are written.

Formats

Target	Transport
Syslog	RFC 5424 over TLS, port 6514 by default
JSON Lines	HTTPS, optionally with a bearer token
Splunk	HTTP Event Collector

Each entry is the line of the file export with its hash, so the SIEM can recompute the chain.

Setting up

1. Open SIEM export and add a target.
2. Choose whether it receives all entries or security events only (sign-ins, users and roles, agents, certificates, the audit log itself, backups and more).
3. Choose the start: from now on, or including every entry already there.
4. A test message must go through before the target receives entries.

Behaviour

• The job worker sends every minute, at least once and in the order written.
• A failing target is retried with a growing pause up to 15 minutes and holds up no other. Only the change between working and failing is logged.
• Only networks the operator allows are reached (SA_SIEM_ALLOWED_NETWORKS, private networks by default; public for a SIEM in the internet), over TLS 1.3 with the certificate verified.
• The token is stored encrypted and asked for again when the target changes.