SIEM Integration
Your SOC already has its detections, dashboards and retention in the SIEM. DNS Watchdog feeds it every finding and DNS change as standard OCSF or CEF events, so none of that has to be rebuilt.
A security team that works from its SIEM should not need another console. A SIEM channel sends every finding, every DNS change and a summary of each scan to your collector over HTTPS, as Open Cybersecurity Schema Framework events or ArcSight Common Event Format lines. Splunk, Microsoft Sentinel, Google SecOps, Amazon Security Lake, IBM QRadar, ArcSight and pipelines such as Cribl Stream ingest them without a custom parser.
Events use the standard OCSF 1.4 classes: Detection Finding for issues, Entity Management for records and zones, and Scan Activity for each scan. Every event carries a stable ID for de-duplication, the affected hostname, IP address and port where there is one, and a link back to the changelog. You choose the wire format your collector expects: a JSON array, NDJSON, Splunk HEC envelopes or CEF.
Delivery is built not to lose findings. Events are batched, transient collector errors are retried with back-off, and a batch that still fails is retried from the queue for most of an hour before it is set aside for recovery, so a collector outage delays events rather than dropping them. A test button sends one clearly labelled event through the same path, so a green test means real events will arrive.
How it works
- Create an endpointSet up an HTTPS ingestion endpoint, and usually a token, in your SIEM.
- Add the channelAdd a SIEM channel with the collector URL, wire format and credential header. The URL and credential are stored encrypted.
- TestSend a labelled test event through the same path real batches use.
- StreamAfter each scan with changes, events are mapped to OCSF and delivered in batches of up to 100.
- RecoverTransient failures are retried. Only a batch that fails repeatedly is set aside, and the channel is flagged so you know.
What you get
- OCSF 1.4 events: Detection Finding, Entity Management and Scan Activity
- JSON array, NDJSON, Splunk HEC or CEF wire formats
- Works with Splunk, Microsoft Sentinel, Google SecOps, Amazon Security Lake, IBM QRadar and ArcSight
- Batched, retried delivery with a stable event ID for de-duplication
- Stream every change type, or only the ones you pick
- Collector URL and credential stored encrypted
Why it matters
No custom parser
Industry schemas mean your SIEM maps the events on arrival, and your existing detections and dashboards apply from day one.
DNS alongside everything else
Correlate a new open port or a changed record with the rest of your telemetry, instead of in a separate console.
Outages don't lose findings
Batching, retries and a stable ID on every event mean a collector blip delays delivery rather than dropping events.
Retention on your terms
Events live in your SIEM under your own retention and access rules, for as long as your audits need them.
FAQ
Which SIEMs are supported?
Any collector that accepts events over HTTPS. The four wire formats cover Splunk HEC, Microsoft Sentinel, Google SecOps, Amazon Security Lake, IBM QRadar and ArcSight, as well as pipelines such as Cribl Stream, Vector and Logstash.
What happens if our collector is down?
Delivery is at-least-once. Transient errors are retried with back-off, and a batch that still fails is retried from the queue about every nine minutes, five times, before being set aside. An outage of well under an hour loses nothing.
Can we send only some events?
Yes. Tick the change types to stream, or leave them all unticked to send findings, DNS changes and the per-scan summary.