Beta: SIEM Integration
Overview
The SIEM Integration feature allows Evo to forward tenant audit events to an external SIEM platform using a customer-provided webhook endpoint. This enables organizations to centralize audit logging, improve visibility, and support monitoring, alerting, and compliance workflows within their existing SIEM solution.
Evo delivers audit events as JSON payloads in batched HTTPS POST requests. Note: This is currently in Beta and requires you joining our Discord and opting into the beta to get access.
Requirements
To configure and manage SIEM integrations, the following are required:
- Must have the following role permission:
- Integrations → Manage SIEM Integrations
Configuring a SIEM Integration
- Navigate to:
Evo Admin → Integrations → SIEM
- Select the desired tenant
- Create a new SIEM configuration
Required Configuration
Setting | Description |
Webhook URL | The HTTPS endpoint Evo will send audit events to |
Optional Configuration
Setting | Description |
Authorization Headers | Custom headers used for authentication, such as API tokens or bearer tokens |
Signing Secret | Used to generate request signatures for webhook verification |
Excluded Audit Actions | Exact audit action names that should not be forwarded to the SIEM |
After saving the configuration, use Test Saved Webhook to verify that the external endpoint successfully accepts Evo webhook requests.
Webhook Delivery
Evo sends audit events as JSON payloads using batched HTTP POST requests.
Delivery Characteristics
- Delivery model is at-least-once
- Duplicate events may occur
- Receivers should implement event deduplication using the event UUID
Webhook Headers
The following headers are included with webhook requests:
Header | Description |
X-Evo-Delivery-Id | Unique delivery trace identifier |
X-Evo-Signature-256 | HMAC SHA-256 request signature. Only included when a signing secret is configured |
Webhook Payload Format
Example webhook payload:
{
"schema_version": "1",
"events": [
{
"event_type": "create",
"table": "events",
"timestamp": "2024-01-15T10:30:00.000Z",
"data": {
"uuid": "evt-abc123",
"action": "User login",
"status": "Success",
"actor": {
"kind": "User",
"name": "user@example.com"
},
"origin": {
"hostname": "DESKTOP-ABC",
"ipaddr": "192.168.1.100"
},
"target": {
"kind": "User",
"name": "user@example.com"
},
"ts": 1706000000000000000,
"created_at": 1706000000000000000
}
}
],
"count": 1,
"generated_at": "2024-01-15T10:30:05.123Z"
}