Overview

The SIEM Integration feature allows Evo to forward tenant audit events to an external SIEM platform using a customer-provided webhook endpoint. This enables organizations to centralize audit logging, improve visibility, and support monitoring, alerting, and compliance workflows within their existing SIEM solution.

Evo delivers audit events as JSON over batched HTTPS POSTs. Choose Evo (default) or Splunk HEC payload format in the SIEM config. Note: This is currently in Beta and requires you joining our Discord and opting into the beta to get access.

Requirements

To configure and manage SIEM integrations, the following are required:

Must have the following role permission:

Integrations → Manage SIEM Integrations

Configuring a SIEM Integration

Navigate to:

Evo Admin → Integrations → SIEM

Select the desired tenant

Create a new SIEM configuration

Required Configuration

Setting	Description
Payload Format	Evo (default webhook envelope) or Splunk HEC (native HTTP Event Collector format)
Webhook URL	HTTPS endpoint for delivery. For Splunk HEC, use the collector URL (e.g. `…/services/collector/event`)

Optional Configuration

Setting	Description
Authorization Headers	Auth headers on every request. For Splunk HEC: `{"Authorization": "Splunk <hec-token>"}`
Signing Secret	HMAC for `X-Evo-Signature-256`. Not used for Splunk HEC
Excluded Audit Actions	Exact audit action names that should not be forwarded to the SIEM

After saving the configuration, use Test Saved Webhook to verify that the external endpoint successfully accepts Evo webhook requests.

Webhook Delivery

Evo sends audit events as JSON payloads using batched HTTP POST requests.

Delivery Characteristics

Delivery model is at-least-once

Duplicate events may occur

Receivers should implement event deduplication using the event UUID

Webhook Headers

The following headers are included with webhook requests:

Header	Description
`X-Evo-Delivery-Id`	Unique delivery trace identifier
`X-Evo-Signature-256`	HMAC SHA-256 of the body. Only when a signing secret is set and payload format is Evo (never sent for Splunk HEC)

Webhook Payload Format (Evo)

Example webhook payload:

{
	"schema_version": "1",
	"events": [
		{
			"event_type": "create",
			"table": "events",
			"timestamp": "2024-01-15T10:30:00.000Z",
			"data": {
				"uuid": "evt-abc123",
				"action": "User login",
				"status": "Success",
				"actor": {
					"kind": "User",
					"name": "user@example.com"
				},
				"origin": {
					"hostname": "DESKTOP-ABC",
					"ipaddr": "192.168.1.100"
				},
				"target": {
					"kind": "User",
					"name": "user@example.com"
				},
				"ts": 1706000000000000000,
				"created_at": 1706000000000000000
			}
		}
	],
"count": 1,
"generated_at": "2024-01-15T10:30:05.123Z"
}

Splunk HEC

When Payload Format = Splunk HEC:

Body is native HEC JSON: time, host (tenant schema), source (evo:audit), sourcetype (evo:audit:json), event (audit fields flattened into event)

One event → single JSON object; multiple events → newline-delimited JSON (NDJSON)

Auth via Authorization header: Splunk <token> (not a signing secret)

Example (single event):

{
  "time": 1706000000.0,
  "host": "evo_01abc…",
  "source": "evo:audit",
  "sourcetype": "evo:audit:json",
  "event": {
    "event_type": "create",
    "table": "events",
    "timestamp": "2024-01-15T10:30:00.000Z",
    "uuid": "evt-abc123",
    "action": "Login",
    "status": "Success",
    "actor": { "kind": "User", "name": "user@example.com" },
    "detail": "Credentials validated"
  }
}

Search tip: sourcetype="evo:audit:json" source="evo:audit"

Evo Support Bot

Beta: SIEM Integration