Stream audit logs to the customer's SIEM in real time
Provide a self-service, configurable way to stream an organization's audit and security events in near real time to the customer's own SIEM / log collector (e.g. Azure Event Hub, Microsoft Sentinel, Splunk, webhook/syslog), in a documented JSON schema over an encrypted, authenticated channel.
This lets customers apply their own retention, alerting and correlation. Today this can only be set up manually as part of a conversion project. Requested by Loram and Vantaan Energia (Vantaan requires a technical interface for real-time exchange of log, event and security data).
4
votes
AdminPaul Phillips
(VP Product Management, Novacura)
shared this idea