SIEM / Log Forwarding

SURF can forward security events (alerts, applications, navigation, malware logs, change/audit logs, download/upload, AI interactions) to your SIEM. Enable a destination under Settings → Integrations and select which event types to forward.

• Splunk — HTTP Event Collector (HEC). Config: HEC token, URL, event types. Alerts are risk-scored (High vs Informative).
• Microsoft Sentinel — Log Ingestion API via Data Collection Endpoint/Rule (recommended; legacy HTTP Data Collector with Workspace ID + key still supported). Config (new): DCE endpoint, DCR immutable ID, Tenant ID, Client ID, Client Secret, event types. Includes AI-interaction events. (Recently migrated to the Log Ingestion API.)
• Google Chronicle — Malachite Ingestion API (UDM events). Config: service-account JSON key, Customer ID, event types.
• ArcSight (Micro Focus / OpenText) — Syslog CEF over UDP/TCP; multiple destinations supported. Config: host, port, protocol, event types.
• Elastic / Elasticsearch — Elasticsearch _doc API; API key (preferred) or basic auth. Config: endpoint, port, API key, event types. (Configured under the name "ElasticSearch".)
• Also available: Logz.io, Datadog, Coralogix; Microsoft Teams & Slack for alert notifications.

IBM QRadar has no dedicated integration — ingest via the ArcSight syslog/CEF path, or use the SURF SIEM pull API.

SURF SIEM pull API (alternative to push) — external SIEMs can poll SURF events (alerts, applications, audit logs, malware logs, navigations) with date/pagination filters via the /siem/v2 endpoint.