How to send Safetica 10 alerts to SIEM

You can choose to send Safetica 10 alerts to your SIEM software. Each Safetica DLP log contains an alert type number and description of the violation.

Integration with SIEM can be set up individually for each alert in the fourth step of alert configuration:

Below, you can see an example of a Safetica DLP log sent to SIEM:

Safetica@1 Id="92334" Type="103014" User="John Smith" Computer="PC101" Details="Unprotected sensitive data leaving the endpoint. Data categories: None. This alert was sent when a large volume of categorized data not protected by DLP policies had left the endpoint. Further data may have left after the alert was sent. (Rules: eMail)"

Logs can be categorized based on the Type number. The table below lists individual Type numbers and the corresponding alert names:

Encoding of the alerts with special characters

We suggest setting up the UTF-8 encoding multibyte encoding in your SIEM if you have alerts with certain accent characters sent from Safetica. Another way would be to not use these characters.