Forward detections, security events and audit events to your SIEM over syslog or a signed webhook, and hand compliance findings to your ticketing system.

Settings → SIEM Export decides where detections and events leave the appliance, how their severity is scored, and how much volume each destination receives. The same page holds the ITSM handoff, which posts compliance findings to your ticketing system as they open, change and close.

What do I need?

Licence: Enterprise
Role: admin_user

Prerequisites

An Enterprise licence. Every route on this page is gated on the integrations.siem capability and answers 403 FEATURE_NOT_LICENSED without it.
You sign in as superadmin. The dashboard lists this pane only for superadmin and for the read-only viewer role, although the API accepts admin_user.
A collector that accepts syslog on a known host and port, or an HTTPS endpoint that accepts a JSON POST.
The appliance can reach that collector — see Network prerequisites.
For a signed webhook: a shared secret your receiver can verify HMAC-SHA256 with.

Screenshot pendingSettings → SIEM Export listing a syslog destination with its severity model, tiers, forwarded and suppressed counts/assets/screenshots/settings-siem-export@0.4.png

What is exported, and what never is

Only metadata leaves the appliance: entity types and counts, never prompt text and never a detected value. The dialog states this before you fill anything in.

A destination subscribes to streams:

Stream	The page calls it	What it carries
`detections`	Detections — every policy hit	Every policy hit, across chat, browser and SWG inspection, the extension and documents.
`security_events`	Security events — blocks, auth failures, errors	Event log rows in the security and error categories.
`audit_events`	Audit events — admin changes, review decisions	Event log rows in the audit category.
`findings`	—	Compliance findings. ITSM destinations only; a SIEM destination cannot subscribe to it, and an ITSM destination cannot subscribe to anything else.

Add a syslog destination

Open the export settings

Select Settings → SIEM Export, then Add destination.

The dialog opens on New destination.

Choose syslog

Set Destination type to Syslog (CEF / JSON).

The host, port, protocol and format fields appear.

Address the collector

Set Host, Port and Protocol — udp, tcp or tls.

TCP and TLS frame one event per line and time out after ten seconds. UDP is fire-and-forget: only a local socket error is ever reported.

Choose the wire format

Set Format to cef, json or ocsf.

CEF is the default and the most compact. OCSF is JSON, so each event is roughly 3.8 times the size of the same event in CEF — the page states the measured figures. On a per-EPS licence nothing changes, because the event count is identical.

Subscribe to streams

Select the streams under Streams.

At least one is required.

Choose the severity model

Set Severity model to Legacy (as shipped) or v2 — residual risk.

Under v2, severity tracks what is still exposed: a detection that was only flagged and reached the model scores higher than one that was blocked. New destinations are created on v2.

Save and test

Select Save, then Send test on the new row.

A toast reports Test event delivered, and a single synthetic event with the signature CID_TEST_EVENT arrives at your collector in the destination's real format.

Warning

Switching the severity model changes what the numbers mean. An alert rule keyed on a threshold matches different events afterwards. Review those rules in your SIEM before you save.

Add a signed webhook destination

Choose the webhook type

Select Add destination and set Destination type to Webhook (JSON batch).

Enter the endpoint

Set URL to an http:// or https:// endpoint.

The appliance POSTs there with a ten-second timeout and follows no redirects. Anything outside the 2xx range is a failure.

Set the shared secret

Enter a value in Shared secret (HMAC).

Each request then carries X-CID-Signature as sha256= followed by the hex HMAC-SHA256 of the exact request body. Leave it blank and no signature header is sent. Once stored, the field shows stored — leave blank to keep.

Save and test

Select Save, then Send test.

Your endpoint receives one POST whose body is {"events":[…]} with a single test event inside, plus the headers X-CID-Event-Count and, when a secret is set, X-CID-Signature.

Control how much a destination receives

Volume discipline is per destination, under What this destination receives.

Control	Effect
Tier A — forward each event	Blocks and rejections on any channel, jailbreak and injection attempts, high-severity data that reached the model, and inspection bypasses. On by default.
Tier B — hourly summary per tenant	Masked and flagged volume as one event per tenant per hour, with a channel breakdown, unique users and the change against the previous hour. On by default.
Agent activity (Claude Code / MCP)	Counts of which agent tools ran and against which repositories, added to the hourly summary. Off by default — it is the largest stream the gateway produces.
Severity floor (1-10)	Events scoring below it are not forwarded and are counted as suppressed. The hourly summary is never muted by the floor.
Event types (opt-in)	A comma-separated allowlist. Empty means every type. It applies only to the security and audit streams.
Tenants / Tenant groups	Forward only these. Select nothing to forward every tenant. Group membership is re-resolved every export cycle.

Tier C — clean traffic, heartbeats, and flags with nothing behind them — is never sent. It stays queryable in All detections.

Danger

A scoped destination stops receiving traffic that could not be attributed to a tenant, which includes unattributed SWG inspection traffic. Changing the scope re-seeds the destination's cursors to now: no history is replayed.

Hand findings to your ticketing system

The ITSM handoff is shipped, not planned. It posts the same signed JSON batch as a SIEM webhook, with a finding inside instead of an event.

Add the destination

Under ITSM handoff, select Add ITSM destination.

The dialog states what travels: the detection reference, its regulations, the owner and the due date — never prompt text and never a detected value.

Point it at your middleware

Set Webhook URL to your automation endpoint.

CID222 does not talk to Jira or ServiceNow directly, because your field mapping and credentials already live in your middleware.

Sign and route

Set Signing secret, add any Custom headers as one Name: value per line, and fill Project / queue key, Issue type, Priority and Default assignee as needed.

The four defaults are passed through untouched so your receiver does not have to hard-code routing. Header values are encrypted at rest and never returned; the page lists only their names afterwards.

Test

Select Send test.

A toast reports Test finding delivered and your endpoint receives a real finding-shaped payload with sentinel values.

Note

Five header names are reserved and cannot be overridden: content-type, content-length, host, x-cid-signature and x-cid-event-count.

Fields reference

What a CEF line looks like

<162>Jul 23 09:00:00 cid-appliance CEF:0|CID222|cid-core|0.4.0|MESSAGE_BLOCKED|message blocked|8|rt=1784797200000 externalId=e1 cat=security_events suid=t1 suser=u1 cs1=s1 cs1Label=sessionId category=SECURITY path=/chat/completions correlation_id=c1

CEF field	CID222 value
Vendor, product	Always the literal strings CID222 and cid-core.
Version	The appliance's application version.
Signature	The event type.
Name	The event type, lower-cased with underscores replaced by spaces.
Severity	0–10, from the destination's severity model.
`rt`	When the event occurred, in epoch milliseconds.
`externalId`	The event's own id.
`cat`	The stream.
`suid`, `suser`, `cs1`	Tenant, user and session, when known.
`src`	The request's source address, on v2 destinations.
`act`	The action taken, when there is one.

The syslog facility is fixed at local4 and is not configurable. The priority follows the CEF severity: 9 and above become critical, 7 and above warning, 4 and above notice, everything else informational.

What a webhook body looks like

One POST carries a batch: {"events":[…]}, where each entry is a flat JSON object with source, stream, id, occurred_at, signature, name, severity, tenant_id, user_id and session_id, followed by the event's own extension keys. ocsf replaces that envelope with OCSF v1.8 class objects.

Delivery behaviour

Property	Value
Export cycle	Every 30 seconds by default (`SIEM_EXPORT_INTERVAL_MS`).
Batch size	200 events, up to five batches per cycle.
Retry	Per cycle, not per request: 1, 2, 4, 8 minutes, capped at 15.
Delivery guarantee	At least once. The cursor advances only after a successful send, so a failure is retried rather than skipped — duplicates are possible, loss is not.
Degraded	After five consecutive failures, or when a backlog stops moving for 30 minutes (`SIEM_EXPORT_DEGRADED_AFTER`, `SIEM_EXPORT_STALL_MS`).

Verify

The destination row shows Forwarded (24h) climbing and Last error empty.
Your collector holds the test event, and the row's Sequence is stamped. Count the events in a window in your SIEM and compare with the sequence range: a shortfall means events were lost between the appliance and the collector. A gap is never expected.
Take the collector offline. Within a few cycles the row is marked Degraded and Event logs records SIEM_EXPORT_DEGRADED with the reason and the consecutive-failure count.
Bring it back. The next successful cycle records SIEM_EXPORT_RECOVERED, and the backlog is delivered rather than skipped.
For a signed webhook, recompute HMAC-SHA256 of the raw body with your secret and compare it with the X-CID-Signature header.

If it fails

The page will not open, or every call returns FEATURE_NOT_LICENSED → SIEM export is an Enterprise capability. See Licence tiers.
config.protocol must be one of udp, tcp, tls or config.format must be one of cef, json, ocsf → an unsupported value. The webhook format list is only json and ocsf.
config.url must be an http(s) URL → the webhook URL has no scheme.
An ITSM destination subscribes to the "findings" stream only or The "findings" stream is delivered by an ITSM destination, not a SIEM one → the two kinds of destination cannot share streams.
"…" is set by the gateway and cannot be overridden → you added one of the five reserved header names.
Send test shows a raw connection error such as a refused connection or a syslog timeout → the appliance cannot reach the collector. The test surfaces the transport's own words.
The row is Degraded with the collector kept refusing delivery → the endpoint is rejecting the batch. Check its status codes; anything outside 2xx is a failure.
The row is Degraded with a backlog stopped moving → nothing has been delivered for 30 minutes although events exist.
Cursor lag is growing but the row is not stalled → the gateway is quiet, not blocked. Lag only means a backlog when the destination is also marked stalled.
A destination receives nothing although events are visible in All detections → check Severity floor, Event types (opt-in) and the tenant scope. Suppressed events are counted in Suppressed (24h).

Next steps

All detections — the same records, queryable on the appliance.
Event logs — the security and audit streams at their source.
Data retention — how long those records survive locally once they are exported.

SIEM and webhook integrations

What do I need?

What is exported, and what never is

Add a syslog destination

Open the export settings

Choose syslog

Address the collector

Choose the wire format

Subscribe to streams

Choose the severity model

Save and test

Add a signed webhook destination

Choose the webhook type

Enter the endpoint

Set the shared secret

Save and test

Control how much a destination receives

Hand findings to your ticketing system

Add the destination

Point it at your middleware

Sign and route

Test

Fields reference

What a CEF line looks like

What a webhook body looks like

Delivery behaviour

Verify

If it fails

Next steps

On this page