Aurva

SIEM Integration

Forward Aurva events to Splunk, Elastic, Datadog, Coralogix, QRadar, and Microsoft Sentinel for centralised security monitoring.

Aurva can push policy violations, risk findings, DAM events, and audit logs to your SIEM or log analytics platform. This keeps Aurva data alongside the rest of your security telemetry for correlation, investigation, and compliance reporting.

Supported SIEMs

PlatformMethodStatus
SplunkHTTP Event Collector (HEC)GA
ElasticElasticsearch APIGA
DatadogLog APIGA
CoralogixREST APIGA
IBM QRadarSyslog (CEF)Beta
Microsoft SentinelLog Analytics APIPlanned

Configuration

Splunk (HEC)

  1. In Splunk, create an HTTP Event Collector token (Settings -> Data Inputs -> HTTP Event Collector).
  2. In Aurva, navigate to Settings -> Integrations -> SIEM and select Splunk.
  3. Provide:
    • HEC endpoint URL (e.g. https://splunk.example.com:8088/services/collector)
    • HEC token
    • Index name (optional, defaults to main)
    • Source type (recommended: aurva:events)
  4. Click Test Connection, then Save.

Elastic

  1. Generate an API key in Kibana (Stack Management -> API Keys).
  2. In Aurva, select Elastic and provide:
    • Elasticsearch endpoint (e.g. https://elastic.example.com:9200)
    • API key
    • Index prefix (default: aurva-events)
  3. Click Test Connection, then Save.

Datadog

  1. Create a Datadog API key (Organisation Settings -> API Keys).
  2. In Aurva, select Datadog and provide:
    • Datadog site (datadoghq.com or datadoghq.eu)
    • API key
    • Service tag (default: aurva)
  3. Click Test Connection, then Save.

Event Schema

All events are delivered as JSON. Below is a representative example:

{
  "event_id": "evt_abc123",
  "event_type": "policy_violation",
  "severity": "high",
  "timestamp": "2026-04-13T10:15:30Z",
  "source": {
    "service": "payment-api",
    "namespace": "production",
    "data_asset": "payments-db"
  },
  "policy": {
    "id": "pol_456",
    "name": "PII access outside business hours",
    "category": "internal_activity"
  },
  "details": {
    "user": "svc-batch-processor",
    "query_hash": "a1b2c3d4",
    "rows_accessed": 15000,
    "classifiers": ["PAN", "Aadhaar", "Email"]
  }
}

Event Types

TypeDescription
policy_violationA policy rule was triggered
risk_findingA new risk was discovered during DSPM scan
dam_eventA database query captured by DAM
audit_eventAn administrative action in the Aurva console