> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update SIEM destination

> Update the endpoint, credentials, or enabled state of an existing SIEM destination.

Updates a SIEM streaming destination. You can change the endpoint URL, rotate credentials, or toggle streaming on and off. Only the fields you include in the request body are updated.

### Parameters

<ParamField path="id" type="string" required>
  The SIEM destination ID (e.g., `siem_abc123`).
</ParamField>

<ParamField body="endpoint" type="string">
  New HTTPS endpoint URL.
</ParamField>

<ParamField body="token" type="string">
  New authentication token (Splunk, Datadog, Elastic).
</ParamField>

<ParamField body="access_key_id" type="string">
  New AWS access key ID (CloudWatch).
</ParamField>

<ParamField body="secret_access_key" type="string">
  New AWS secret access key (CloudWatch).
</ParamField>

<ParamField body="secret" type="string">
  New shared secret (custom webhook).
</ParamField>

<ParamField body="enabled" type="boolean">
  Enable or disable streaming.
</ParamField>

### Responses