How to send Safetica alerts to SIEM

You can choose to integrate Safetica alerts with your SIEM software. Alerts sent to SIEM contain an alert type number and description of the incident.

Integration with SIEM can be set up individually for each alert:

1. Open Safetica Maintenance Console and set up a new alert as described here.
2. In the 4th step, called Reporting, you can integrate the alert with your SIEM by adding the SIEM server address and port. The SIEM server must be available from the respective Safetica server.

Alerts sent to SIEM contain an alert Type number and the description of the incident. 

Below, you can see an example of a Safetica log sent to SIEM:

Safetica@1 Id="92334" Type="103014" User="John Smith" Computer="PC101" Details="Unprotected sensitive data leaving the endpoint. Data categories: None. This alert was sent when a large volume of categorized data not protected by DLP policies had left the endpoint. Further data may have left after the alert was sent. (Rules: eMail)"

When creating a parser or categorizing the alert Type number via SIEM, the Type number has to be translated based on these tables:

Encoding of alerts with special characters

If you use certain accent characters in your alerts, we suggest setting up the UTF-8 multibyte encoding in your SIEM. You can also choose not to use these characters.