> For the complete documentation index, see [llms.txt](https://docs.couchdrop.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.couchdrop.io/integrations/siem.md).

# SIEM integrations

Learn about logging and SIEM support in Couchdrop

## Introduction

Couchdrop can send account and file activity to external logging and SIEM platforms for centralized monitoring, investigation, and security analysis.

Supported logging providers include **Splunk**, **Datadog**, **Azure Monitor Logs for Microsoft Sentinel**, **Elastic**, and **Webhooks**. You can connect one or multiple providers depending on how your organization collects and analyzes security events.

Events are sent as structured JSON, allowing your SIEM or logging platform to ingest Couchdrop activity alongside logs from your other systems.

### Supported SIEM and logging providers

Couchdrop supports the following external logging destinations.

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Splunk</strong></td><td>Send events to Splunk using the HTTP Event Collector.</td><td><a href="/integrations/siem/splunk.md">Splunk</a></td></tr><tr><td><strong>Datadog</strong></td><td>Send Couchdrop events to Datadog Logs.</td><td><a href="/integrations/siem/datadog.md">Datadog</a></td></tr><tr><td><strong>Microsoft Sentinel</strong></td><td>Send events through Azure Monitor Logs for use with Microsoft Sentinel.</td><td><a href="/integrations/siem/microsoft-sentinel.md">Microsoft Sentinel</a></td></tr><tr><td><strong>Elastic</strong></td><td>Send events to Elastic through Logstash.</td><td><a href="/integrations/siem/elastic.md">Elastic</a></td></tr><tr><td><strong>Webhook</strong></td><td>Send event data as JSON to a webhook endpoint.</td><td><a href="/integrations/siem/webhook.md">Webhook</a></td></tr></tbody></table>

You can configure more than one provider if Couchdrop events need to be delivered to multiple logging or security systems.

### Event types

When configuring a logging provider, you can select which types of Couchdrop events should be sent.

Available event categories include:

* **Login** — Authentication and login activity.
* **Admin changes** — Administrative changes made within Couchdrop.
* **Failures** — Failed operations and events.
* **File based actions** — Activity involving files and file transfers.

Selecting only the event categories required by your organization can help keep your external logging destination focused on the activity relevant to your monitoring requirements.

## Configuring SIEM logging

{% hint style="warning" %}

#### Before you start

To configure SIEM logging, you will need:

* A Couchdrop account with access to the SIEM logging settings.
* The connection details or credentials required by your selected logging provider.
  {% endhint %}

{% stepper %}
{% step %}

### Select a logging provider

Log in to Couchdrop and navigate to **Admin Panel** → **Logging**.

Locate the provider you want to configure and select **Connect**.
{% endstep %}

{% step %}

### Select the events to send

Choose the Couchdrop event types that should be sent to the logging provider.

You can send login activity, administrative changes, failures, file-based actions, or a combination of these event types.
{% endstep %}

{% step %}

### Configure the provider

Enter the configuration values required by your selected logging provider.

Each provider has different authentication and destination requirements. Refer to the provider-specific Couchdrop documentation for its configuration requirements.
{% endstep %}

{% step %}

### Save the integration

Click **Save Updates** to save the logging configuration.

Couchdrop can now send the selected events to the configured provider.
{% endstep %}
{% endstepper %}

## Provider-specific configuration

The connection details required depend on the logging platform you are using.

* **Splunk** requires an Event Collector token and HTTP Event Collector URI.
* **Datadog** requires a Datadog Application Key and API Key.
* **Microsoft Sentinel** uses Azure Monitor Logs and requires the Azure Monitor configuration values created in Azure.
* **Elastic** requires the Elastic username, password, and URL for the configured Logstash HTTP input.
* **Webhook** sends Couchdrop event data to your configured webhook endpoint.

Once a provider is connected, Couchdrop sends the selected event categories to that destination as JSON logging data.

## Couchdrop event format

Couchdrop sends logging events as JSON. The properties included in an event depend on the activity that generated it.

An example Couchdrop event is shown below:

```json
{
  "id": "",
  "event_id": "",
  "token": "",
  "account": "",
  "organisation_id": "",
  "filename": "",
  "filename_relative": "",
  "path": "",
  "relative_path": "",
  "timestamp": 1750721574,
  "TimeGenerated": "2025-06-24T11:32:54.000Z",
  "authenticated_user": "",
  "authenticated_user_id": "",
  "storage_engine": "",
  "storage_engine_id": "",
  "event_type": "",
  "ip_address": "",
  "success": true,
  "total_size": 0,
  "file_size": 0,
  "additional_info": "",
  "system": "",
  "transaction_id": "",
  "region": "",
  "workflow_id": "",
  "workflow_action": "",
  "node": "",
  "message": "",
  "is_support_generated": false,
  "inbox_id": "",
  "shared_link_id": "",
  "error_type": "",
  "error_message": "",
  "error_original": "",
  "elapsed": 0,
  "as2_mdn_payload": "",
  "as2_station_id": "",
  "inbound_s3_bucket_id": "",
  "inbound_s3_bucket_key_id": "",
  "sender": "",
  "ingress_retry": 0,
  "text": "",
  "ingress": true,
  "ingress_status": {}
}
```

The payload provides information about the event itself together with relevant user, file, storage, workflow, transfer, and error information when applicable.