SIEM Integration
SIEM (Security Information and Event Management) integration allows you to export MeetLoyd security events to external security tools for centralized monitoring and analysis.
SIEM integration is available on Enterprise plans only.
Why SIEM Integration?
- Centralized monitoring: Correlate MeetLoyd events with your other security data
- Real-time streaming: Events flow to your SIEM as they happen
- Compliance reporting: Unified audit trail across all your systems
- Threat detection: Use your SIEM's analytics to detect anomalies in agent behavior
Supported SIEM Platforms
| Platform | Description |
|---|---|
| Splunk | Enterprise security analytics |
| Datadog | Cloud monitoring and security |
| Elastic Security | Open-source SIEM |
| SumoLogic | Cloud-native analytics and SIEM |
| Custom HTTP endpoints | Any system that accepts webhooks (including Microsoft Sentinel, AWS Security Hub, and others) |
Event Types
| Event Category | Events |
|---|---|
| Authentication | Login, logout, failed attempts, MFA events |
| User Management | Created, updated, deleted, role changed |
| Agent Operations | Created, deleted, sensitive actions |
| Admin Actions | Settings changes, permission grants |
| Security Events | Incidents, approvals, session terminations |
Event Format
Events are sent in JSON format with a consistent structure including event type, timestamp, actor details (user ID, email), action details (IP address, user agent, method), tenant ID, and severity level.
MeetLoyd also supports CEF (Common Event Format) for ArcSight and Splunk, and LEEF (Log Event Extended Format) for IBM QRadar.
Feature Availability
| Feature | Enterprise |
|---|---|
| SIEM Destinations | Up to 5 |
| Real-time Streaming | Yes |
| Custom Event Filters | Yes |
| Batch Export | Yes |
Configuring SIEM
Access SIEM configuration through the Security Center:
- Navigate to Security in the top bar
- Click on the SIEM tab
- Click Add Destination
Setup Steps
- Select platform: Choose your SIEM platform (Splunk, Datadog, Elastic, etc.)
- Configure connection: Enter the endpoint URL, authentication token, and any platform-specific settings (index name, source type, etc.)
- Select events: Choose which event categories to export (authentication, user management, agent operations, admin actions, security events)
- Set format: Choose JSON, CEF, or LEEF depending on your SIEM requirements
- Test connection: Send a test event to verify configuration
- Enable streaming: Activate real-time event export
Platform-Specific Notes
Splunk: Provide the HEC (HTTP Event Collector) URL and token. Specify the target index and source type.
Datadog: Provide your Datadog API key and site (datadoghq.com, datadoghq.eu, etc.).
Elastic: Provide node URLs, authentication credentials (basic auth or API key), and optional ingest pipeline name.
SumoLogic: Provide your Sumo Logic HTTP Source URL. Events are sent in JSON format.
Custom HTTP: Provide any webhook URL with optional bearer token, basic auth, or HMAC signature verification. Use this for platforms like Microsoft Sentinel (via Azure Log Analytics workspace) or AWS Security Hub.
Related: Security Center | Audit Logs