Get early access
Features · Security & Backup · SIEM Forwarding
Security & Backup · SIEM Forwarding

Stream every event
to Splunk, Sentinel, Datadog or Elastic.

Audit log, alerts, incidents, agent events — pushed to your SIEM in near real-time. CEF, LEEF, ECS or raw JSON. Replayable on reconnect; back-pressure aware.

forwarder · splunk
events audit · alerts · incidents format ECS JSON transport HTTPS, mTLS lag under 5 s on failure buffered, replayed
— Why this matters

Your SIEM is where the security team already looks.

01

Another console is not an improvement.

If your analysts live in Splunk, an event that only exists in our UI is an event they will not see.

02

Our downtime must not be your gap.

Forwarding is queued and fire-and-forget. If your endpoint is unreachable, events keep being generated and retried, not dropped at the source.

— What's included

Formats, transports, and what happens when it fails.

Five formats
Generic JSON, Syslog RFC5424, CEF for ArcSight and Splunk, Elastic Common Schema, and Azure Sentinel's data collector shape.
Four transports
HTTPS, TCP with TLS, and UDP when you want speed over acknowledgement.
Auth to match
Bearer token, API key header, HTTP Basic, or Sentinel's signed shared key. Credentials encrypted at rest.
Filter what you send
Glob patterns per forwarder — ssh.*, alert.*, ai.* — or everything.
Custom headers
For workspace IDs, routing keys, and whatever else your collector insists on.
Retries with backoff
Three attempts, 60 seconds apart, per event.
Per-forwarder stats
Events sent, events failed, last success, last error — so a silently broken forwarder is visible.
Test button
Sends one synthetic event, so you find out the endpoint is wrong now rather than during an incident.
Hooked in at the source
Anything that records an event anywhere in the platform reaches your configured forwarders. Nothing to wire up per feature.
— Works with

Connected capabilities

Audit Log
The primary source of forwarded events.
→
Notification Channels
Counterpart for user-facing alerts; SIEM is for machine consumption.
→
Policy Engine
Use SIEM-reachable signals for ongoing compliance evidence.
→
Webhooks
Generic outbound option if SIEM forwarders don't fit.
→
— FAQ

Questions, answered honestly.

Is there a throughput cap? +
Soft 10k events / sec per destination on Enterprise. Above that, contact us — we've done it.
Encryption in transit? +
TLS 1.3 mandatory for Splunk HEC, Sentinel, Datadog. TLS optional for syslog (TCP); strongly recommended.
Can I forward a subset to one SIEM and everything to another? +
Yes — destinations are independent. Per-destination filter rules.

Make HostAtlas a first-class source in your SIEM.

SIEM forwarding on Enterprise.

Get early access Back to Security & Backup