Skip to main content

Background

Logging Lumos events to your SIEM lets you create alerts for critical access or app-related events in Lumos. If Lumos doesn’t have a native integration with your SIEM, you can create a SIEM webhook that pushes every SIEM event to an HTTP endpoint of your choosing. SeeHow Lumos Logs to Your SIEM This article shows you how to add a SIEM webhook in Lumos and connect it to an arbitrary HTTP endpoint.

What’s sent in the webhook?

Lumos sends an HTTP POST with a JSON payload of log data when the webhook is triggered. The format of this payload is below.

How should my script or workflow respond?

A SIEM webhook will be considered successful if the Endpoint URL returns any HTTP 2XX response.

How do I start sending webhooks to my SIEM?

  1. Create a SIEM webhook. SeeCreating Webhooks
  2. Navigate to your SIEM settings, choose your webhook in the dropdown, then click the Save button.
Your webhook will now begin broadcasting events to your desired endpoint every time a new Activity Log entry is created.