SIEM Integration

VeraID exports audit logs and security events to your Security Information and Event Management (SIEM) platform in real time. This enables centralized security monitoring, correlation with other data sources, and compliance reporting.

Supported Platforms

Platform	Type	Transport	Default Format
Splunk	SPLUNK	HTTPS (HEC)	JSON
Datadog	DATADOG	HTTPS	JSON
Sumo Logic	SUMOLOGIC	HTTPS	JSON
Elastic	ELASTIC	HTTPS	JSON
Generic Syslog	SYSLOG	TCP/UDP/TLS	Syslog (RFC 5424)
Generic HTTPS	HTTPS	HTTPS	JSON

Supported Formats

Format	Description	Use Case
CEF	Common Event Format	ArcSight, QRadar, and other CEF-compatible SIEMs
LEEF	Log Event Extended Format	IBM QRadar native format
JSON	Structured JSON	Splunk, Datadog, Elastic, Sumo Logic, and custom pipelines
SYSLOG	RFC 5424 Syslog	Syslog collectors and legacy SIEM platforms

Authentication Types

Type	Identifier	Description
API Key	API_KEY	API key sent as a header (e.g., Datadog DD-API-KEY)
Bearer Token	BEARER_TOKEN	OAuth2 bearer token in Authorization header
Basic Auth	BASIC_AUTH	Username and password with HTTP Basic Authentication
None	NONE	No authentication (e.g., internal syslog collectors)

Note

Splunk uses the HTTP Event Collector (HEC) token, which is passed as an API_KEY authentication type with the header name Authorization and value Splunk <token>.

---

Creating a SIEM Integration

API

curl -X POST https://app.veraid.io/api/v1/siem/integrations \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production Splunk",
    "type": "SPLUNK",
    "endpoint": "https://splunk.company.com:8088/services/collector/event",
    "authType": "API_KEY",
    "authConfig": {
      "headerName": "Authorization",
      "headerValue": "Splunk abc123-def456-ghi789"
    },
    "format": "JSON",
    "filters": {
      "severities": ["HIGH", "CRITICAL"],
      "eventTypes": [
        "identity.created",
        "identity.suspended",
        "credential.rotated",
        "credential.used",
        "anomaly.detected",
        "policy.violated"
      ]
    }
  }'

Response:

{
  "id": "siem_abc123",
  "name": "Production Splunk",
  "type": "SPLUNK",
  "endpoint": "https://splunk.company.com:8088/services/collector/event",
  "authType": "API_KEY",
  "format": "JSON",
  "status": "ACTIVE",
  "filters": {
    "severities": ["HIGH", "CRITICAL"],
    "eventTypes": [
      "identity.created",
      "identity.suspended",
      "credential.rotated",
      "credential.used",
      "anomaly.detected",
      "policy.violated"
    ]
  },
  "createdAt": "2026-03-19T10:00:00Z",
  "lastEventAt": null,
  "stats": {
    "totalEventsSent": 0,
    "lastHourEventsSent": 0,
    "failedEvents": 0
  }
}

Request Fields

Field	Type	Required	Description
name	string	Yes	Display name for the integration
type	string	Yes	Platform type: SPLUNK, DATADOG, SUMOLOGIC, ELASTIC, SYSLOG, HTTPS
endpoint	string	Yes	URL or host:port of the SIEM collector
authType	string	Yes	Authentication type: API_KEY, BEARER_TOKEN, BASIC_AUTH, NONE
authConfig	object	Conditional	Authentication configuration (required unless authType is NONE)
format	string	No	Output format: CEF, LEEF, JSON, SYSLOG. Defaults to JSON
filters	object	No	Event filtering by severity and event type

---

Platform-Specific Configuration

Splunk

{
  "name": "Splunk HEC",
  "type": "SPLUNK",
  "endpoint": "https://splunk.company.com:8088/services/collector/event",
  "authType": "API_KEY",
  "authConfig": {
    "headerName": "Authorization",
    "headerValue": "Splunk your-hec-token"
  },
  "format": "JSON"
}

Events are sent as Splunk HEC JSON payloads:

{
  "event": {
    "action": "credential.rotated",
    "actorType": "SYSTEM",
    "actorId": "system",
    "resourceType": "credential",
    "resourceId": "cred_abc123",
    "outcome": "SUCCESS",
    "severity": "MEDIUM",
    "metadata": {
      "identityName": "aws-deploy-prod",
      "rotationReason": "scheduled",
      "gracePeriodHours": 24
    }
  },
  "time": 1742382000,
  "sourcetype": "veraid:audit",
  "source": "veraid",
  "host": "app.veraid.io"
}

Datadog

{
  "name": "Datadog Logs",
  "type": "DATADOG",
  "endpoint": "https://http-intake.logs.datadoghq.com/api/v2/logs",
  "authType": "API_KEY",
  "authConfig": {
    "headerName": "DD-API-KEY",
    "headerValue": "your-datadog-api-key"
  },
  "format": "JSON"
}

Sumo Logic

{
  "name": "Sumo Logic Collector",
  "type": "SUMOLOGIC",
  "endpoint": "https://collectors.sumologic.com/receiver/v1/http/your-collector-url",
  "authType": "NONE",
  "format": "JSON"
}

Tip

Sumo Logic HTTP collectors use a unique URL that serves as both the endpoint and authentication. No separate auth configuration is needed.

Elastic

{
  "name": "Elastic SIEM",
  "type": "ELASTIC",
  "endpoint": "https://elastic.company.com:9200/veraid-events/_doc",
  "authType": "BASIC_AUTH",
  "authConfig": {
    "username": "veraid_ingest",
    "password": "your-password"
  },
  "format": "JSON"
}

Generic Syslog

{
  "name": "Syslog Collector",
  "type": "SYSLOG",
  "endpoint": "syslog.company.com:514",
  "authType": "NONE",
  "format": "SYSLOG",
  "config": {
    "transport": "TLS",
    "facility": "LOCAL0"
  }
}

Generic HTTPS

For SIEM platforms not explicitly supported, use the generic HTTPS integration:

{
  "name": "Custom SIEM",
  "type": "HTTPS",
  "endpoint": "https://siem.company.com/api/ingest",
  "authType": "BEARER_TOKEN",
  "authConfig": {
    "token": "your-bearer-token"
  },
  "format": "JSON"
}

---

Severity and Event Type Filtering

Filter which events are forwarded to your SIEM to control volume and relevance.

Severity Filtering

{
  "filters": {
    "severities": ["CRITICAL", "HIGH", "MEDIUM"]
  }
}

Available severities: CRITICAL, HIGH, MEDIUM, LOW, INFO.

Event Type Filtering

{
  "filters": {
    "eventTypes": [
      "identity.created",
      "identity.updated",
      "identity.suspended",
      "identity.revoked",
      "credential.created",
      "credential.used",
      "credential.rotated",
      "credential.expired",
      "credential.revoked",
      "policy.violated",
      "policy.evaluated",
      "anomaly.detected",
      "alert.triggered",
      "jit.requested",
      "jit.approved",
      "jit.denied"
    ]
  }
}

Caution

Filtering out credential.used events can significantly reduce volume but may limit your ability to detect anomalous access patterns in your SIEM. Consider keeping these events for high-risk identities even if you filter them for low-risk ones.

---

Testing a Connection

Verify that VeraID can successfully deliver events to your SIEM before enabling production streaming.

curl -X POST https://app.veraid.io/api/v1/siem/integrations/{id}/test \
  -H "Authorization: Bearer kd_live_your_api_key"

Response:

{
  "status": "SUCCESS",
  "message": "Test event delivered successfully",
  "details": {
    "endpoint": "https://splunk.company.com:8088/services/collector/event",
    "responseCode": 200,
    "latency": "145ms"
  }
}

If the test fails, the response includes diagnostic information:

{
  "status": "FAILED",
  "message": "Connection refused",
  "details": {
    "endpoint": "https://splunk.company.com:8088/services/collector/event",
    "error": "ECONNREFUSED",
    "suggestion": "Verify that the endpoint is reachable and the port is open. Check firewall rules and network policies."
  }
}

---

Audit Log Export

In addition to real-time streaming, you can export audit logs in bulk for historical analysis or compliance archives.

curl -X GET "https://app.veraid.io/api/v1/audit-logs/export?format=json&startDate=2026-03-01&endDate=2026-03-19" \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -o audit-logs-march.json

Supported export formats:

Format	Content-Type	Description
json	application/json	JSON array of audit log entries
csv	text/csv	CSV with headers, suitable for spreadsheet analysis

Tip

Schedule regular audit log exports using the VeraID API and your organization’s automation tooling to maintain an offline archive for compliance and forensic analysis.

Event Schema

All events forwarded to your SIEM follow a consistent schema regardless of the output format:

{
  "id": "evt_abc123",
  "timestamp": "2026-03-19T10:30:00Z",
  "action": "credential.used",
  "actorType": "IDENTITY",
  "actorId": "id_xyz789",
  "actorName": "aws-deploy-prod",
  "resourceType": "credential",
  "resourceId": "cred_def456",
  "outcome": "SUCCESS",
  "severity": "INFO",
  "ipAddress": "203.0.113.42",
  "userAgent": "veraid-sdk/1.2.0",
  "organizationId": "org_abc",
  "metadata": {
    "scopes": ["secrets.read"],
    "endpoint": "/api/v1/secrets/db-url"
  }
}

When using CEF format, the same event is rendered as:

CEF:0|VeraID|IdentityPlatform|1.0|credential.used|Credential Used|3|src=203.0.113.42 suser=aws-deploy-prod outcome=SUCCESS cs1=cred_def456 cs1Label=credentialId