SIEM Integration¶

CyberArmor forwards events to enterprise SIEMs through real per-connector delivery. Each connector is configured and enabled per tenant.

Supported connectors¶

Connector	Notes
Splunk	HTTP Event Collector
Microsoft Sentinel	Log Analytics ingestion
IBM QRadar	event forwarding
Elastic	index ingestion
Google SecOps (Chronicle)	ingestion API
Syslog / CEF	standard syslog transport

Configuration¶

Connector schemas come live from the SIEM service, so the configuration form stays in sync if a connector's fields ever change. Secret fields (tokens, keys) are write-only.

Endpoint	Audience
`GET /customer/siem/outputs/types`	tenant admin — available connector types + fields
`GET /customer/siem/outputs`	tenant admin — configured outputs
`POST /customer/siem/outputs/configure`	create/reconfigure an output
`PATCH /customer/siem/outputs/{id}/toggle`	enable/disable
`POST /customer/siem/outputs/{id}/test`	send a test event
`DELETE /customer/siem/outputs/{id}`	remove an output

Platform admins can manage a tenant's connectors on their behalf through the admin dashboard's SIEM view.

Validation checklist¶

GET /customer/siem/outputs/types returns the connector catalog with field schemas
a configured connector's Test action delivers a test event to the destination
a disabled connector stops receiving events immediately