SIEM Settings tab
Note
To view the SIEM Settings tab, the option to use SIEM must be enabled in the organization settings.
SIEM Settings tab
In the SIEM Settings tab, you will find an overview of all the information and settings available to you for managing a company's users.
The following options are available:
| Element | Description |
|---|---|
| SIEM provider | Defines the SIEM provider.NoteCurrently, only Splunk is supported as an HTTP Event Collector (HEC). |
| Host | Defines the name of the host for data transfer. |
| Port | Defines the port of a host for the connection used to transfer data. |
| API tokens | Defines the API token for authentication with the host.NoteThe API token used must be a HEX token. |
The following information is shown in the SIEM log when SIEM is activated:
Data recorded in the SIEM log
| Function | Event |
|---|---|
| Company | Edit company |
| Networks | Add Network |
| Edit network | |
| Delete network | |
| Mitigation | Automatic mitigation started |
| Automatic mitigation completed | |
| Start Manual mitigation | |
| Stop manual mitigation | |
| User management | Add account |
| Delete account | |
| Verify email | |
| Reset password | |
| Enable and disable 2FA |
The following information is not shown in the SIEM log:
| Function | Event |
|---|---|
| Company | Edit company |
| Delete company | |
| SOC mode | Add SOC user/admin |
| Delete SOC user/admin | |
| Verify email | |
| Reset password | |
| Enable and disable 2FA |