Skip to main content
Sign in
Deutsch Español Français Italiano

SIEM

SIEM HTTP event forwarder

The SIEM HTTP Event Forwarder is a component that serializes messages in JSON format and sends them to the SIEM HTTP endpoint. This functionality is useful for configuring a SIEM (Security Information and Event Management) system that can receive and analyze data from various sources.

Configuration

To configure the SIEM HTTP Event Forwarder, you need to set the following options:

  • Enable forwarder: enable or disable the HTTP event forwarder service
  • SIEM vendor: select the vendor to auto-compile the Event format field.
  • HTTP Endpoint URL: the complete URL of the HTTP endpoint that will receive serialized JSON messages. For example: https://example.siem.corp/messages.
  • HTTP Header (optional): the HTTP header that will be added to the message when sent to the endpoint. For example: Authentication token: .
  • Event Format: the format of the data in JSON that will be serialized and sent to the endpoint. It mus contain the %message% keyword.

Event Format

The message is serialized in JSON format and must be specified in event format. The supported keywords are:

  • %message%: the message, in JSON format. (mandatory, should be specified in the event format)
  • %hostname%: the hostname of the appliance that receive the message (optional)
  • %timestamp%: the date the message was received, in UNIX timestamp format (optional)
  • %datetime%: the date the message was received, in RFC3339 format (optional)

splunk example

Related articles