SIEM onboarding

Connect AuthMantra audit events to your SIEM by signed webhook or Splunk HEC, and check it works.

Streaming identity events puts sign-ins and admin changes beside the rest of your security data. Each event has an id, time, organization, actor, action, target, status, ip and detail.

Before you connect

Decide which team owns the alerts.
Create a receiving endpoint over HTTPS, or a Splunk HTTP Event Collector token.
Store the shared secret in a secrets manager, not in a chat.

Connect and verify

Add the destination in the admin console.
Verify the X-AuthMantra-Signature header: t=<unix>,v1=<HMAC-SHA-256 of t, a dot and the raw body>.
Reject requests whose timestamp is old.
Send a test event and confirm it arrives intact.