Stream security events to SIEM tools

Identity events only help if they reach the place you already correlate logs. Security and audit events can now stream to Sysdig, Splunk, Sumo Logic, and Microsoft Sentinel through environment notification channels.

This is the longer note behind the July 22 changelog entry.

How it works

Notification channels already pushed selected event types to a generic webhook or Slack. The new channel types forward the same audit and authentication stream to a SIEM using that product's native intake:

• Sysdig — Events API (sysdigApiToken; optional region, source, tags)
• Splunk — HTTP Event Collector (splunkToken and HEC base URL)
• Sumo Logic — HTTP Source (sumoUrl; the collector URL is the credential)
• Microsoft Sentinel — Azure Log Analytics Data Collector (sentinelWorkspaceId and sentinelSharedKey)

A SIEM channel with an empty eventTypes array drains all events. List the catalog first if you want a filter.

SIEM forwarding is not Lidar. Lidar runs detectors inside Authdog and surfaces Signals in the console. These channels copy the event trail to an external tool for your own correlation and retention.

Deliveries participate in the same records, retry, test, and redelivery flow as other channels. SIEM destinations use the platform's native authentication instead of X-Authdog-Signature. Sentinel redelivery re-signs the stored payload with the current shared key.

Set it up

In the console, open the environment's notification channels (see Events & webhooks):

1. Create a channel and pick sysdig, splunk, sumologic, or sentinel.
2. Fill the required fields for that type. Secret values are not returned on later list calls; responses include a *Configured boolean instead.
3. Leave eventTypes empty for the full stream, or list types from the events catalog.
4. Send a test delivery before you rely on the channel.
5. If a delivery failed, redeliver from the delivery record after you fix the receiver.

You can also create channels through POST /v1/tenants/{tenantId}/environments/{environmentId}/notification-channels. Update with PUT and omit a stored secret to preserve it.

Trust boundaries

Channel secrets (HEC tokens, Sumo collector URLs, Sentinel shared keys) are credentials. Store them only in Authdog. Anyone who can read notification-channel configuration can redirect or duplicate your event stream.

A successful delivery proves Authdog reached the SIEM. It does not prove the event was an attack, and it does not replace Lidar triage. Generic webhook signature verification does not apply to these four types; trust the destination's own auth instead.

Retries and manual redelivery can send the same logical event more than once. Make the SIEM side idempotent on delivery id or event id.

Try it

Create a Sentinel or Splunk channel in a development environment, send a test event, then redeliver one record. Walkthrough: SIEM & Security Events and Events & webhooks. The original release note is in the changelog.