Skip to main content
Updates a SIEM streaming destination. You can change the endpoint URL, rotate credentials, or toggle streaming on and off. Only the fields you include in the request body are updated.

​
Parameters

​
id
string
required
The SIEM destination ID (e.g., siem_abc123).
​
endpoint
string
New HTTPS endpoint URL.
​
token
string
New authentication token (Splunk, Datadog, Elastic).
​
access_key_id
string
New AWS access key ID (CloudWatch).
​
secret_access_key
string
New AWS secret access key (CloudWatch).
​
secret
string
New shared secret (custom webhook).
​
enabled
boolean
Enable or disable streaming.

​
Responses

{
  "id": "siem_abc123",
  "provider": "splunk",
  "endpoint": "https://hec-new.splunk.example.com:8088/services/collector",
  "enabled": true,
  "created_at": "2026-06-30T12:00:00Z",
  "updated_at": "2026-06-30T14:00:00Z",
  "status": "active"
}

curl -X PUT https://api.truthlocks.com/v1/audit/siem/siem_abc123 \
  -H "X-API-Key: tl_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "endpoint": "https://hec-new.splunk.example.com:8088/services/collector",
    "token": "your-new-hec-token"
  }'