Skip to main content
PUT
Update SIEM destination
The public audit SIEM destination CRUD routes are not registered in the current backend. This contract describes an unfinished integration and requests may return 404. Do not submit SIEM credentials or rely on this page to configure streaming. Risk-event export is a separate capability, documented under the risk SIEM export reference.
Updates a SIEM streaming destination. You can change the endpoint URL, rotate credentials, or toggle streaming on and off. Only the fields you include in the request body are updated.

Responses

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Path Parameters

id
string
required

SIEM destination ID.

Body

application/json
endpoint
string<uri>

New HTTPS endpoint URL.

token
string

New authentication token (Splunk, Datadog, Elastic).

access_key_id
string

New AWS access key ID (CloudWatch).

secret_access_key
string

New AWS secret access key (CloudWatch).

secret
string

New shared secret (webhook).

enabled
boolean

Enable or disable streaming.

Response

Updated SIEM destination.

id
string
provider
string
endpoint
string
enabled
boolean
created_at
string<date-time>
updated_at
string<date-time>
status
string