> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/integrations/siem.md).

# SIEM integrations

Learn about logging and SIEM support in Couchdrop

## Introduction

Couchdrop can send account and file activity to external logging and SIEM platforms for centralized monitoring, investigation, and security analysis.

Supported logging providers include **Splunk**, **Datadog**, **Azure Monitor Logs for Microsoft Sentinel**, **Elastic**, and **Webhooks**. You can connect one or multiple providers depending on how your organization collects and analyzes security events.

Events are sent as structured JSON, allowing your SIEM or logging platform to ingest Couchdrop activity alongside logs from your other systems.

### Supported SIEM and logging providers

Couchdrop supports the following external logging destinations.

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Splunk</strong></td><td>Send events to Splunk using the HTTP Event Collector.</td><td><a href="/integrations/siem/splunk.md">Splunk</a></td></tr><tr><td><strong>Datadog</strong></td><td>Send Couchdrop events to Datadog Logs.</td><td><a href="/integrations/siem/datadog.md">Datadog</a></td></tr><tr><td><strong>Microsoft Sentinel</strong></td><td>Send events through Azure Monitor Logs for use with Microsoft Sentinel.</td><td><a href="/integrations/siem/microsoft-sentinel.md">Microsoft Sentinel</a></td></tr><tr><td><strong>Elastic</strong></td><td>Send events to Elastic through Logstash.</td><td><a href="/integrations/siem/elastic.md">Elastic</a></td></tr><tr><td><strong>Webhook</strong></td><td>Send event data as JSON to a webhook endpoint.</td><td><a href="/integrations/siem/webhook.md">Webhook</a></td></tr></tbody></table>

You can configure more than one provider if Couchdrop events need to be delivered to multiple logging or security systems.

### Event types

When configuring a logging provider, you can select which types of Couchdrop events should be sent.

Available event categories include:

* **Login** — Authentication and login activity.
* **Admin changes** — Administrative changes made within Couchdrop.
* **Failures** — Failed operations and events.
* **File based actions** — Activity involving files and file transfers.

Selecting only the event categories required by your organization can help keep your external logging destination focused on the activity relevant to your monitoring requirements.

## Configuring SIEM logging

{% hint style="warning" %}

#### Before you start

To configure SIEM logging, you will need:

* A Couchdrop account with access to the SIEM logging settings.
* The connection details or credentials required by your selected logging provider.
  {% endhint %}

{% stepper %}
{% step %}

### Select a logging provider

Log in to Couchdrop and navigate to **Admin Panel** → **Logging**.

Locate the provider you want to configure and select **Connect**.
{% endstep %}

{% step %}

### Select the events to send

Choose the Couchdrop event types that should be sent to the logging provider.

You can send login activity, administrative changes, failures, file-based actions, or a combination of these event types.
{% endstep %}

{% step %}

### Configure the provider

Enter the configuration values required by your selected logging provider.

Each provider has different authentication and destination requirements. Refer to the provider-specific Couchdrop documentation for its configuration requirements.
{% endstep %}

{% step %}

### Save the integration

Click **Save Updates** to save the logging configuration.

Couchdrop can now send the selected events to the configured provider.
{% endstep %}
{% endstepper %}

## Provider-specific configuration

The connection details required depend on the logging platform you are using.

* **Splunk** requires an Event Collector token and HTTP Event Collector URI.
* **Datadog** requires a Datadog Application Key and API Key.
* **Microsoft Sentinel** uses Azure Monitor Logs and requires the Azure Monitor configuration values created in Azure.
* **Elastic** requires the Elastic username, password, and URL for the configured Logstash HTTP input.
* **Webhook** sends Couchdrop event data to your configured webhook endpoint.

Once a provider is connected, Couchdrop sends the selected event categories to that destination as JSON logging data.

## Couchdrop event format

Couchdrop sends logging events as JSON. The properties included in an event depend on the activity that generated it.

An example Couchdrop event is shown below:

```json
{
  "id": "",
  "event_id": "",
  "token": "",
  "account": "",
  "organisation_id": "",
  "filename": "",
  "filename_relative": "",
  "path": "",
  "relative_path": "",
  "timestamp": 1750721574,
  "TimeGenerated": "2025-06-24T11:32:54.000Z",
  "authenticated_user": "",
  "authenticated_user_id": "",
  "storage_engine": "",
  "storage_engine_id": "",
  "event_type": "",
  "ip_address": "",
  "success": true,
  "total_size": 0,
  "file_size": 0,
  "additional_info": "",
  "system": "",
  "transaction_id": "",
  "region": "",
  "workflow_id": "",
  "workflow_action": "",
  "node": "",
  "message": "",
  "is_support_generated": false,
  "inbox_id": "",
  "shared_link_id": "",
  "error_type": "",
  "error_message": "",
  "error_original": "",
  "elapsed": 0,
  "as2_mdn_payload": "",
  "as2_station_id": "",
  "inbound_s3_bucket_id": "",
  "inbound_s3_bucket_key_id": "",
  "sender": "",
  "ingress_retry": 0,
  "text": "",
  "ingress": true,
  "ingress_status": {}
}
```

The payload provides information about the event itself together with relevant user, file, storage, workflow, transfer, and error information when applicable.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.couchdrop.io/integrations/siem.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.