Skip to content

SIEM Integration

SentriKat can forward vulnerability events to your SIEM via syslog, enabling centralized security monitoring and correlation with other security data sources.

New in v1.0.2

SIEM/syslog integration was added in SentriKat v1.0.2.

PRO Feature

SIEM integration requires a PRO license.

Supported SIEMs

SentriKat has been tested with:

SIEM Protocol Format
Splunk Syslog (TCP/UDP) CEF, JSON
Elastic / ELK Syslog (TCP) JSON, RFC 5424
ArcSight Syslog (TCP) CEF
QRadar Syslog (TCP/UDP) CEF, RFC 5424

Any SIEM that accepts syslog input will work with SentriKat.

Configuration

Where SIEM forwarding is configured

SIEM forwarding is configured in the application, not in .env. The settings live in the database and are edited from the admin UI, so a change takes effect without a restart.

Go to Settings > SIEM / Syslog and set:

Setting Values Default
Enabled on / off off
Host your collector's hostname or IP —
Port usually 514 514
Protocol udp or tcp udp
Format cef, json, or rfc5424 cef
Facility syslog facility local0

Syslog forwarding is plaintext

There is no TLS syslog support: events are sent over plain UDP or TCP. Keep the collector on a trusted network segment, or terminate TLS with a local forwarder (rsyslog, syslog-ng, Vector) that SentriKat delivers to over loopback.

After changing these settings:

docker compose restart sentrikat

Web UI Configuration

You can also configure SIEM settings via the admin panel:

  1. Go to Settings > SIEM / Syslog
  2. Enter your SIEM host and port
  3. Select the log format
  4. Click Test Connection
  5. Save

Log Formats

CEF (Common Event Format)

The CEF format is widely supported by enterprise SIEMs (ArcSight, QRadar, Splunk):

CEF:0|SentriKat|VulnMgmt|1.0.2|KEV_MATCH|Vulnerability Matched|9|
  src=agent-hostname
  cve=CVE-2024-3400
  severity=Critical
  product=PAN-OS
  vendor=Palo Alto Networks
  status=AFFECTED
  dueDate=2024-04-19
  ransomware=Yes
  epss=0.972
  org=Acme Corp

JSON

Structured JSON for Elastic/ELK and modern SIEMs:

{
  "timestamp": "2026-02-11T10:30:00Z",
  "event_type": "kev_match",
  "severity": "Critical",
  "cve_id": "CVE-2024-3400",
  "product": "PAN-OS",
  "vendor": "Palo Alto Networks",
  "status": "AFFECTED",
  "confidence": "high",
  "due_date": "2024-04-19",
  "ransomware": true,
  "epss_score": 0.972,
  "organization": "Acme Corp",
  "agent_hostname": "fw-01.corp.local"
}

RFC 5424

Standard syslog format with structured data:

<134>1 2026-02-11T10:30:00Z sentrikat vulnmgmt - KEV_MATCH [vuln@sentrikat cve="CVE-2024-3400" severity="Critical" product="PAN-OS" status="AFFECTED" dueDate="2024-04-19"] Vulnerability CVE-2024-3400 matched on PAN-OS

Event Types

SentriKat forwards the following event types:

Event Trigger Severity Mapping
kev_match A newly exploited vulnerability matches a product Based on CVSS
status_change Vulnerability status changes (e.g., AFFECTED → RESOLVED) Informational
due_date_approaching remediation due date within configured threshold Warning
due_date_overdue remediation due date has passed High
new_agent New agent registered Informational
agent_offline Agent missed check-in threshold Warning

Filtering

Control which events are forwarded:

# Only forward events at or above this severity (critical, high, medium, low, info)
SIEM_MIN_SEVERITY=high

# Event types to forward (comma-separated, or "all")
SIEM_EVENT_TYPES=kev_match,status_change,due_date_overdue

# Only forward events from specific organizations (comma-separated org IDs, or "all")
SIEM_ORGANIZATIONS=all

SIEM-Specific Setup

Splunk

  1. In Splunk, go to Settings > Data Inputs > TCP or UDP
  2. Add a new input on the port SentriKat will send to
  3. Set Source Type to sentrikat or cef depending on your format
  4. Configure SentriKat with the Splunk receiver's host and port

Elastic / ELK

  1. Configure a Logstash syslog input: 
    input {
  syslog {
    port => 5514
    codec => json_lines
  }
}
  2. Create an index template for SentriKat events
  3. Point SentriKat to your Logstash host

QRadar

  1. In QRadar, go to Admin > Data Sources > Log Sources
  2. Add a new log source with protocol Syslog
  3. Set the log source type to Universal CEF
  4. Configure SentriKat to use CEF format

Testing

Verify SIEM forwarding is working:

# Or via API
curl -X POST http://localhost:5000/api/settings/syslog/test \
  -b cookies.txt

Troubleshooting

Events Not Arriving

  1. Verify SIEM_ENABLED=true in your .env
  2. Check network connectivity: docker compose exec sentrikat nc -zv siem.company.local 514
  3. Verify your SIEM is listening on the configured port
  4. Check SentriKat logs: docker compose logs sentrikat | grep SIEM

TLS Connection Issues

  1. Verify the certificate is mounted into the container
  2. Check certificate expiry and chain
  3. Try with SIEM_TLS_VERIFY=false temporarily to isolate certificate issues

Next Steps