SIEM Event Streaming

Stream your Organization Audit Trail to external Security Information and Event Management (SIEM) platforms in real time. Configure webhook endpoints that receive HMAC-SHA256 signed payloads for every audit event — member changes, role assignments, webhook lifecycle, and more — enabling centralized security monitoring, compliance dashboards, and automated incident response.

How It Works

┌───────────────────────────────────────────────┐
│          Organization Audit Trail              │
│     (OrgAuditService.log() — fire-and-forget)  │
└──────────────────┬────────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│          SiemDeliveryService.dispatch()        │
│                                                │
│  1. Find active webhooks matching event type   │
│  2. Fan out to all matching endpoints          │
│  3. Sign payload with HMAC-SHA256              │
│  4. POST to each endpoint                      │
│  5. Retry failed deliveries (3 attempts)       │
│  6. Log delivery result                        │
└──────┬────────────────────┬───────────────────┘
       │                    │
       ▼                    ▼
┌──────────────┐    ┌──────────────┐
│   Splunk HEC  │    │   Datadog    │
│  (webhook A)  │    │  (webhook B) │
└──────────────┘    └──────────────┘

Every call to OrgAuditService.log() asynchronously triggers the SIEM delivery pipeline. Webhook delivery is fire-and-forget — audit logging performance is never impacted, even if all external endpoints are down.

Webhook Configuration

Creating a Webhook

Organization admins with the MANAGE_WEBHOOKS permission can register up to 10 SIEM webhook endpoints per Organization:

mutation CreateSiemWebhook($input: CreateSiemWebhookInput!) {
	createSiemWebhook(input: $input) {
		id
		organizationId
		name
		url
		signingSecret # ← save this! never shown again
		isActive
	}
}

Input:

{
	"input": {
		"orgId": "org-enterprise-01",
		"name": "Splunk HEC — Production",
		"url": "https://splunk.corp.example.com/services/collector/event",
		"eventTypes": [],
		"headers": {
			"Authorization": "Splunk YOUR_HEC_TOKEN"
		}
	}
}

Important: The signingSecret is returned only on create and rotate operations. Copy it immediately — it cannot be retrieved later.

Updating a Webhook

mutation UpdateSiemWebhook($input: UpdateSiemWebhookInput!) {
	updateSiemWebhook(input: $input) {
		id
		name
		url
		isActive
	}
}

All fields except webhookId and orgId are optional — only provided fields are updated:

{
	"input": {
		"webhookId": "wh-abc123",
		"orgId": "org-enterprise-01",
		"name": "Splunk HEC — Staging",
		"isActive": false
	}
}

Listing Webhooks

query {
	siemWebhooks(orgId: "org-enterprise-01") {
		id
		name
		url
		isActive
		eventTypes
		createdAt
		updatedAt
	}
}

Signing secrets are masked in list/detail queries (e.g., whsec_ab••••••7890). Sensitive header values (keys matching secret, token, key, auth) are also masked.

Deleting a Webhook

mutation {
	deleteSiemWebhook(orgId: "org-enterprise-01", webhookId: "wh-abc123") {
		id
		name
	}
}

Secret Management

Each webhook has a cryptographically generated signing secret (whsec_ prefix + 32 random bytes, hex-encoded). This secret is used to compute HMAC-SHA256 signatures for every delivered payload.

Rotating a Secret

If a signing secret is compromised, rotate it immediately:

mutation {
	rotateSiemWebhookSecret(orgId: "org-enterprise-01", webhookId: "wh-abc123") {
		id
		signingSecret # ← the NEW secret (save it!)
	}
}

The old secret becomes invalid immediately. Update your SIEM integration's signature verification to use the new secret.

Test Send

Verify connectivity before relying on a webhook for production monitoring:

mutation {
	testSiemWebhook(orgId: "org-enterprise-01", webhookId: "wh-abc123") {
		success
		httpStatus
		error
	}
}

This sends a synthetic TEST_EVENT payload to the endpoint — useful for validating URL reachability, authentication, and signature verification logic on the receiving side.

Payload Format

Every SIEM delivery is a POST request with a JSON body:

{
	"event": {
		"id": "evt_a1b2c3d4e5f6",
		"organizationId": "org-enterprise-01",
		"eventType": "ROLE_CHANGED",
		"actorId": "user-admin-01",
		"targetUserId": "user-member-42",
		"metadata": {
			"oldRole": "MEMBER",
			"newRole": "ADMIN"
		},
		"ipAddress": "203.0.113.42",
		"createdAt": "2026-04-08T17:00:00.000Z"
	},
	"webhookId": "wh-abc123",
	"timestamp": "2026-04-08T17:00:01.234Z"
}

HTTP Headers

Verifying Signatures

On your SIEM receiver, verify the payload authenticity by computing the HMAC and comparing:

import { createHmac } from 'crypto';

function verifyWebhookSignature(rawBody: string, signatureHeader: string, secret: string): boolean {
	const expected = createHmac('sha256', secret).update(rawBody).digest('hex');
	const received = signatureHeader.replace('sha256=', '');
	return expected === received;
}

// In your Express/Fastify handler:
app.post('/siem-webhook', (req, res) => {
	const isValid = verifyWebhookSignature(
		req.rawBody,
		req.headers['x-webhook-signature'],
		process.env.SIEM_SIGNING_SECRET
	);
	if (!isValid) return res.status(401).send('Invalid signature');
	// Process event...
	res.status(200).send('OK');
});

Event Types

Webhooks can be filtered to specific event types. If eventTypes is empty (the default), the webhook receives all audit events for the Organization.

Delivery Resilience

Retry Strategy

Failed deliveries are retried with exponential backoff:

After 3 failed attempts, the delivery is marked as FAILED and logged for monitoring.

Delivery Logs

Track delivery health via the siemDeliveryLogs query:

query {
	siemDeliveryLogs(orgId: "org-enterprise-01", webhookId: "wh-abc123", limit: 20, status: FAILED) {
		id
		eventId
		status # PENDING | DELIVERED | FAILED
		httpStatus
		attempts
		error
		lastAttemptAt
		createdAt
	}
}

Delivery logs have a 30-day TTL — MongoDB automatically removes entries older than 30 days via a TTL index on createdAt.

Delivery Status Reference

Security

URL Validation

Webhook URLs are validated at create and update time:

These rules prevent Server-Side Request Forgery (SSRF) attacks where a malicious webhook URL could probe internal infrastructure.

Secret Masking

• Signing secrets are returned in full only on create and rotate operations
• All subsequent reads mask the secret (e.g., whsec_ab••••••7890)
• Custom header values matching secret, token, key, or auth are masked on read

Axios Security

Webhook HTTP requests use axios@1.14.0, which includes patches for:

• CVE-2024-39338: SSRF via protocol-relative URLs
• CVE-2025-27152: SSRF via absolute URL overrides

Permission Model

File Reference

Testing

# Unit tests
npm run test -- apps/organizations

# E2E tests
npx jest --config apps/organizations/test/jest-e2e.json --testPathPattern siem

Related

• Organizations & Permissions — Base Organization infrastructure, roles, and the audit trail that SIEM webhooks stream from
• Custom RBAC — Admin-defined custom roles — MANAGE_WEBHOOKS can be granted to custom roles for delegated webhook management
• Corporate Identity (SAML & SCIM) — Enterprise identity events (SAML logins, SCIM provisioning) are streamed to SIEM endpoints
• Edit History Audit Trail — Field-level change tracking — complementary to SIEM streaming for compliance
• Advanced Audit Logging UI — Frontend UI that hosts the SIEM webhook management panel alongside the Organization Audit Log