> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/documentation/management-console/integrations/siem-integration.md). # SIEM Integration GuardWare SIEM Integration allows external Security Information and Event Management (SIEM) platforms to collect security and activity events from GuardWare through an API. This enables security teams to centralise event data for monitoring, analysis, correlation, and investigation. Administrators configure the integration in the GuardWare Management Console. The configuration determines which event categories and incident severities the SIEM collector can retrieve, the response format, and the maximum number of events returned in a response. ## How SIEM Integration Works SIEM Integration uses an API-based log collection process. The SIEM collector requests available events from GuardWare according to its configured collection schedule. The collection process works as follows: 1. GuardWare records security and activity events. 2. The SIEM collector requests events through the GuardWare API. 3. GuardWare returns events that match the configured event categories and incident severities, subject to the configured response limit. 4. The SIEM collector processes the returned events according to its ingestion configuration. 5. The SIEM platform makes the collected events available for monitoring, analysis, and investigation. The collection frequency determines how often the SIEM checks for available events. Events are retrieved when the collector requests them, rather than being transferred immediately whenever an event occurs. The volume of data collected depends on the selected event categories, incident severities, collection frequency, and maximum response limit. ## Configure SIEM Integration {% stepper %} {% step %} ### Configure API Access GuardWare generates an API credential for the SIEM collector. The collector uses this credential to authenticate its API requests. Ensure that the credential remains valid for the intended collection period. If it expires, the collector must use a valid credential to continue retrieving events.

1. Navigate to **Resources** > **SIEM Integration** in the Management Console. 2. Under **API access**, configure the following settings.

Setting	Description
Integration Name	Enter a name that identifies the SIEM integration, such as `Production SIEM`.
Authentication Method	Select the authentication method supported by the integration. The current interface provides API Key as the default selection.
Credential Expires At	Set the credential validity period. For example, select 365 days for a one-year expiry period.
Request Frequency	Select the collection interval appropriate for the SIEM collector. The available options determine the configured request frequency.

{% endstep %} {% step %} ### Configure Log Response Settings Under **Log Response Settings**, configure the response format and maximum number of events returned by the API.

{% stepper %} {% step %} #### Log Format Select the format the SIEM collector can process. * **JSON:** Returns events in JSON format. This is the default format shown in the Management Console. * **Syslog:** Use this format where it is supported by the integration and required by the receiving SIEM platform. The available formats depend on the integration configuration. Ensure that the selected format is compatible with the collector's ingestion and parsing configuration. {% endstep %} {% step %} #### Maximum logs per API response Specify the maximum number of events that GuardWare can return in a single API response. The interface shows a default value of **100** and describes a proposed configurable range of **1 to 10,000 events per request**. This setting limits the number of events returned in an individual response. If additional events are available, the collector can retrieve them through subsequent requests using the response cursor. {% endstep %} {% step %} #### Preview Response Format Click **Preview Response Format** to inspect the structure of the API response. Use the preview to verify that the selected response format is compatible with the SIEM collector. The collector must parse the response correctly to make the returned events available for searching, correlation, and investigation. {% endstep %} {% endstepper %} {% endstep %} {% step %} ### Select Log Categories Under **Log available to this collector**, select the event categories that the SIEM is permitted to retrieve.

Click **Select All** to select all listed categories, or **Clear All** to clear the current selection. You can also select individual categories according to your monitoring requirements. The available categories are:

Category	Description
External SharePoint Events	Events associated with external SharePoint activity.
Internal SharePoint Events	Events associated with internal SharePoint activity.
Email Activities	Events associated with email activity.
Data Transfer using Non-Corporate Websites	Events associated with data transfers through non-corporate websites.
File Uploads to Non-Corporate File Sharing Applications	Events associated with file uploads to non-corporate file-sharing applications.
Storage Device Risk	Events associated with storage-device risks.
Printing Incidents	Events associated with printing incidents.
Key Stroke Capture	Events associated with captured keystroke activity.
Copy Paste	Events associated with copy-and-paste activity.
Access of Documents on Local Devices	Events associated with access to documents on local devices.
Usage of AI Tools	Events associated with the use of AI tools.
Usage of Non-Corporate Websites	Events associated with the use of non-corporate websites.
Usage of Non-Corporate Applications	Events associated with the use of non-corporate applications.
External Google Drive Events	Events associated with external Google Drive activity.
Internal Google Drive Events	Events associated with internal Google Drive activity.
Screen Capture	Events associated with screen-capture activity.

Select at least one log category to satisfy the configuration requirement shown in the Management Console. {% endstep %} {% step %} ### Select Incident Severity Under **Incident Severity**, select the incident severities the SIEM collector should retrieve.

The available options are: * **HIGHEST** * **HIGH** * **MEDIUM** * **LOW** * **NO RISK** Events are filtered using both the selected log categories and the selected incident severities. If no incident severity is selected, GuardWare includes events across all severities, including events without an assigned incident severity. This allows the collector to retrieve activity events that do not have a classified incident severity. Changing the selected severities affects which events are included in subsequent collection requests. If a severity is deselected, collection of events matching that severity is paused. Selecting it again allows collection to continue from where it was left off. {% endstep %} {% step %} ### Create API Access Before creating the configuration, review the integration name, authentication method, credential expiry, request frequency, response settings, log categories, and incident severities. 1. Verify that the selected settings meet your collection requirements. 2. Click **Create API Access**. 3. Configure the SIEM collector to authenticate using the generated API credential. 4. Configure the collector to request events at the selected frequency and process the selected response format. 5. Verify that the collector can retrieve and ingest events successfully. {% endstep %} {% endstepper %} ## Understand the Collected Events GuardWare events provide information that security teams can use to investigate activity, identify potential data loss, and correlate events across systems. Depending on the event type and the information available in the source record, collected events may include the following fields.

Field	Description
Event ID	Identifier of the source event.
Event Type	Type of event recorded, such as an email or file-upload violation.
Incident Type	Category associated with the event.
Risk ID	Identifier of the risk associated with the event.
Risk Name	Name of the associated risk.
Priority	Priority assigned to the risk in the tenant's risk settings.
Timestamp	Date and time associated with the event.
User	User associated with the activity, where available.
Device	Device associated with the event, where available.
Rule	DLP rule associated with the event, where applicable.
Description	Summary of the event, where available.

The fields available in an event depend on its type and the source information recorded by GuardWare. #### Risk IDs and Priorities Risk IDs identify the risks associated with GuardWare events. Each tenant configures the priority assigned to each risk. Where supported by the integration, use risk IDs for SIEM correlation rules and searches that need to remain consistent when risk names change. Use risk names and priorities to make events easier to interpret and prioritise. ## Maintain Log Collection The SIEM collector must continue making authenticated requests according to its configured schedule to retrieve new events. The amount of data collected depends on the selected log categories and incident severities, the collection interval, and the maximum number of events returned per response. #### Verify Collection If event collection stops or the SIEM does not receive the expected events, check the following: 1. **API credentials:** Verify that the credential is valid and has not expired. 2. **Authentication configuration:** Confirm that the collector uses the authentication method and credentials configured for the integration. 3. **Event categories:** Verify that the required log categories are selected. 4. **Incident severities:** Check that the required severities are selected. 5. **Response format:** Confirm that the SIEM collector can parse the configured format. 6. **Response limit:** Check whether the configured maximum number of events is sufficient for the collection workload. 7. **Collection schedule:** Verify that the collector is running and making requests at the configured frequency. 8. **Ingestion configuration:** Confirm that the SIEM is processing the returned events as expected. A successful API request does not necessarily mean that new events are available. The selected filters and the availability of matching events determine what the collector receives. #### Changes to Incident Severity Selections Review the effect of severity changes before modifying an existing integration. Deselecting a severity pauses collection for that severity. Selecting it again allows collection to resume according to the integration's collection behaviour. After changing the configuration, verify that the collector continues retrieving and ingesting the expected events. ### Security and Data Handling SIEM events may contain sensitive business and personal information. Depending on the event type, this may include usernames, device names, file names and paths, email metadata, URLs, or information associated with detected sensitive content. When configuring SIEM collection: * Restrict access to the SIEM integration credentials. * Store credentials securely and replace them when required. * Apply appropriate access controls to the collected events. * Configure retention and access policies in accordance with your organisation's security and data-handling requirements. * Ensure that the SIEM collector and receiving platform are configured to process the selected event format securely. Review the information collected by each event category before enabling it, particularly where events may contain sensitive content. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.guardware.com/documentation/management-console/integrations/siem-integration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.