Send events to your SIEM

Use the SIEM card in Settings › Notification Channels to send OpenLatch events over HTTPS to your SIEM, as OCSF 1.1.0 events. Before you start, you need the admin role or higher, and an HTTPS ingestion endpoint in your SIEM with the credentials it accepts.

What a SIEM receives

Drawer section	What it sends
Anomalies	Agent actions that violate an intent policy, with their verdict
Audit trail	Every admin action, with the actor and request IP, as OCSF API Activity
Digests	The scheduled reports you tick for this destination
Activity stream	Every event the console lists on the Events page, Allow included, sent as OCSF 1.1.0 batches

Presets

Pick your SIEM under Which SIEM?. Each preset brings its setup guide, its connection fields and the body format your SIEM expects.

Preset	Body format
Microsoft Sentinel	JSON array
Splunk	Splunk HEC envelope
IBM QRadar	JSON array
Google SecOps	NDJSON
Cortex XSIAM	NDJSON
Elastic Security	Elastic bulk (NDJSON)
Generic HTTPS	The format you choose: JSON array, NDJSON, Splunk HEC envelope or Elastic bulk (NDJSON)

Connect a SIEM

1. On the SIEM card, choose Configure.
2. Under Which SIEM?, pick your SIEM’s preset. Its setup guide opens above the connection fields.
3. Follow the setup guide, then fill in Connection: the ingestion URL and the credentials.
4. Choose what the destination receives: anomalies, the audit trail, digests and the activity stream. Save.
5. Under Send test event, send a test, and check that it arrives and parses in your SIEM.

The SIEM is fixed once the channel is saved: to switch to another SIEM, create a new channel.

Set up Elastic Security

Caution

Elastic Cloud API keys reach Elasticsearch on Serverless only when granted Elasticsearch access; on Hosted, create the key in Kibana.

1. Create an API key whose role grants create_doc and auto_configure on logs-openlatch.* only:

   {"openlatch-siem": {"index": [{"names": ["logs-openlatch.*"], "privileges": ["create_doc", "auto_configure"]}]}}

2. Optional, recommended: install the OpenLatch index template, also linked from the setup guide, which maps the timestamp and the OCSF objects.

3. Paste the bulk URL of your deployment and the header value ApiKey <key> in Connection.

4. Send a test event, and check that it lands in logs-openlatch.siem-default.

Every event goes to Elasticsearch as a bulk create, with the event’s metadata.uid as the document id, so a re-sent event is refused as a duplicate within the same backing index. When Elasticsearch cannot map an event, that event counts as failed with the hint “Elastic rejected the event mapping — install the OpenLatch index template”.

Stream your agents’ activity to a SIEM

Turn on Stream activity to this channel in the drawer’s Activity stream section. The stream starts at that moment, and sends every event the console lists, Allow included. The events streamed are those each agent reports, which depends on the agent: see Control levels.

Setting	What it does
Event types, Verdicts, Tools, Agents	Narrow what streams, as on every channel: see Filter what streams
Send every	1 min, 5 min, 30 min or 1 h. Events are buffered and sent in batches when the interval is due
Content	Send prompt text and tool input, off by default, behind a confirmation, as on a custom webhook: see Send prompt text and tool input

Each request carries up to 100 events and at most 900,000 bytes, in the preset’s body format. With the stream on, Send test event also sends one sample activity batch, and shows both results when they differ.

Delivery is at least once: deduplicate on each event’s metadata.uid, which stays the same on every re-send. Events more than 24 hours old are not sent; they stay on the Events page. Each channel row shows when the stream falls behind or stops, as on every channel: see Read a channel’s stream status.

For the fields of each event, see Activity stream events.