SIEM integrations

Learn about logging and SIEM support in Couchdrop

Introduction

Couchdrop can send account and file activity to external logging and SIEM platforms for centralized monitoring, investigation, and security analysis.

Supported logging providers include Splunk, Datadog, Azure Monitor Logs for Microsoft Sentinel, Elastic, and Webhooks. You can connect one or multiple providers depending on how your organization collects and analyzes security events.

Events are sent as structured JSON, allowing your SIEM or logging platform to ingest Couchdrop activity alongside logs from your other systems.

Supported SIEM and logging providers

Couchdrop supports the following external logging destinations.

Splunk

Send events to Splunk using the HTTP Event Collector.

Datadog

Send Couchdrop events to Datadog Logs.

Microsoft Sentinel

Send events through Azure Monitor Logs for use with Microsoft Sentinel.

Elastic

Send events to Elastic through Logstash.

Webhook

Send event data as JSON to a webhook endpoint.

You can configure more than one provider if Couchdrop events need to be delivered to multiple logging or security systems.

Event types

When configuring a logging provider, you can select which types of Couchdrop events should be sent.

Available event categories include:

• Login — Authentication and login activity.

• Admin changes — Administrative changes made within Couchdrop.

• Failures — Failed operations and events.

• File based actions — Activity involving files and file transfers.

Selecting only the event categories required by your organization can help keep your external logging destination focused on the activity relevant to your monitoring requirements.

Configuring SIEM logging

Before you start

To configure SIEM logging, you will need:

• A Couchdrop account with access to the SIEM logging settings.

• The connection details or credentials required by your selected logging provider.

1

Select a logging provider

Log in to Couchdrop and navigate to Admin Panel → Logging.

Locate the provider you want to configure and select Connect.

2

Select the events to send

Choose the Couchdrop event types that should be sent to the logging provider.

You can send login activity, administrative changes, failures, file-based actions, or a combination of these event types.

3

Configure the provider

Enter the configuration values required by your selected logging provider.

Each provider has different authentication and destination requirements. Refer to the provider-specific Couchdrop documentation for its configuration requirements.

4

Save the integration

Click Save Updates to save the logging configuration.

Couchdrop can now send the selected events to the configured provider.

Provider-specific configuration

The connection details required depend on the logging platform you are using.

• Splunk requires an Event Collector token and HTTP Event Collector URI.

• Datadog requires a Datadog Application Key and API Key.

• Microsoft Sentinel uses Azure Monitor Logs and requires the Azure Monitor configuration values created in Azure.

• Elastic requires the Elastic username, password, and URL for the configured Logstash HTTP input.

• Webhook sends Couchdrop event data to your configured webhook endpoint.

Once a provider is connected, Couchdrop sends the selected event categories to that destination as JSON logging data.

Couchdrop event format

Couchdrop sends logging events as JSON. The properties included in an event depend on the activity that generated it.

An example Couchdrop event is shown below:

{
  "id": "",
  "event_id": "",
  "token": "",
  "account": "",
  "organisation_id": "",
  "filename": "",
  "filename_relative": "",
  "path": "",
  "relative_path": "",
  "timestamp": 1750721574,
  "TimeGenerated": "2025-06-24T11:32:54.000Z",
  "authenticated_user": "",
  "authenticated_user_id": "",
  "storage_engine": "",
  "storage_engine_id": "",
  "event_type": "",
  "ip_address": "",
  "success": true,
  "total_size": 0,
  "file_size": 0,
  "additional_info": "",
  "system": "",
  "transaction_id": "",
  "region": "",
  "workflow_id": "",
  "workflow_action": "",
  "node": "",
  "message": "",
  "is_support_generated": false,
  "inbox_id": "",
  "shared_link_id": "",
  "error_type": "",
  "error_message": "",
  "error_original": "",
  "elapsed": 0,
  "as2_mdn_payload": "",
  "as2_station_id": "",
  "inbound_s3_bucket_id": "",
  "inbound_s3_bucket_key_id": "",
  "sender": "",
  "ingress_retry": 0,
  "text": "",
  "ingress": true,
  "ingress_status": {}
}

The payload provides information about the event itself together with relevant user, file, storage, workflow, transfer, and error information when applicable.