Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

SIEM Integrations

Overview

Integrate your SIEM (Security Information and Event Management) tools with Material to send data like logs and threat data to use downstream for automated SIEM playbooks and more.

How do Material and SIEM integrations work together?

Material pushes workspace events to your SIEM in real-time. When a critical incident occurs, your playbooks trigger instantly with the full picture already attached, drastically cutting down your mean time to respond.

Material supports SIEM correlation and detection rules in a couple key ways:

  • Event Streaming and Data Integration: Material provides webhook-based event subscriptions that stream events directly to your SIEM in near real-time. You can subscribe to events and filter by specific detection type, like vulnerability or email threats. The events are sent as JSON payloads containing detailed context about threats, entities, and analysis that you can configure your SIEM tool to use as needed.

  • Threat Intelligence Enrichment: Material provides enriched threat data including IP reputation, URL analysis, and file analysis that can enhance your SIEM's correlation capabilities and provide additional context for security events

Should I integrate with SIEM or SOAR first?

The general recommendation is to integrate with your SIEM for data ingestion and enrichment, then use your existing SIEM-to-SOAR workflow for automated response actions, however Material can accommodate direct SOAR integration if that better fits your architecture.

Available SIEM Integrations

To set up an integration, you'll

  1. Create an event destination in your third-party tool

  2. Configure the integration in Material including adding triggering events

Some SIEM integrations come with preconfigured triggering events tailored to common use cases for that tool, so you can get started without manual setup. These include:

For all tools, complete steps one and two below. You can edit the preconfigured events as needed.

Don't see your tool? Use a custom SIEM integration — if your tool accepts HTTPS JSON payloads, it works with Material.

How to create a custom SIEM integration

A Super Admin or Tenant Admin role is required to create custom SIEM integrations.

One: Create an event destination in the third-party tool

Custom SIEM integrations are achieved via webhook. In the SIEM's webhook or connector interface:

  1. Create and secure a webhook endpoint handler to receive event data requests (most often POST). Refer to your tool's documentation for instructions on how to do this. (See links above for pre-configured integration doc links).

  2. Copy the endpoint URI and any required headers for use in the next section.

Two: Configure the SIEM integration in Material

  1. In Material, click Integrations (the puzzle icon in the top toolbar).

  2. Click Create New Integration.

  3. Scroll to SIEM, then click Custom SIEM. Complete the required fields:

This is most often POST , however refer to your tool's documentation for the required method for their destination.

The full HTTPS destination or endpoint URL for your tool; check their documentation or support. Create a unique custom webhook for each endpoint you need to deliver to.

Include any required headers for your destination. Sometimes this includes an auth header with a password; check your destination's documentation to confirm.

Choose the event(s) that will trigger your custom SIEM webhook. Use the form to build the trigger based on multiple filters.

  • The most common event used is Issue Change . It covers most needs.

  • Other common filters are:

    • Severities: trigger based on an issue severity change

    • Detection: trigger based on a specific detection

    • Classifications: trigger based on an issue's classification (for example, route only issues that auto-classification left as Unknown)

  • Choose the option to Include events for messages being added / removed / interacted with in a phishing case if you want to also trigger based on individual message level changes (rather than just issue level changes).

  • While you can include multiple events in one integration, you can only include one of each event type (i.e. one issue change, etc.) All the filters must match to trigger the event. If you need to trigger webhook using OR logic, create multiple integrations with different event parameters.

  • Toggle events off/on at any time in the integration view.

  • Once your custom SIEM webhook starts firing, the last time an event triggered is included in the integration view, under Events:

  1. Add as many events as desired. You can clone events rather than filling out the form each time. Open the actions menu (⋯) on the event row, then click Clone.

  2. Integrations are toggled on by default, so if you want to test it first, toggle the integration Off, then save the Integration.

  3. Open an event, then click Send Test Event to test your connection. (You need to save the integration first to see this option).

  • All webhooks send payloads with the same fields in JSON format. Event descriptions in the app are legacy API documentation. For API v1 documentation, see the API v1 reference.

  • Material verifies SSL certificates when delivering payloads.

  • Once you have saved the integration, you can click Copy Test Event to view an example payload.

Example Payload

You can view a test event to help you build a receiver for JSON events without having to send test events and log the payload.

From the event, click View Test Event to open a window with the full JSON payload and copy it to your clipboard.

You need to save your integration first for this option to appear. See step 6 above.

From an integration, open an event row to view a test event

Disable an integration

  1. From the Integrations page, open the integration.

  2. On the top right, toggle Off.

Event Delivery Behavior

Monitoring and Latency

  • Latency, retries, and time-outs

    • For the best experience, your endpoint needs to be able to keep up with incoming webhook events. We automatically retry failed deliveries, but if an endpoint continues to fail, we may disable the associated events. We recommend checking your event subscriptions from time to time to ensure they remain active.

  • Deduplication

    • Payloads aren't always deduplicated. It's best practice to implement deduplication logic at your destination.

Troubleshooting

Test your endpoint

We recommend you always test your webhook in Material using the Send Test Event button.

Common Errors

Error Code
Description
Solution

400

Bad Request

Confirm your payload fields are formatted correctly for your tool's requirements

401

Unauthorized

Verify token

403

Forbidden

Check your headers in the payload to confirm correct permissions and roles including bearer tokens

404

Not found

Verify your endpoint URL

408

Timeout

Double check your endpoint and tool requirements

502

Bad Gateway

Verify your endpoint URL, any intermediate infrastructure such as a load balancer or proxy, and your webhook implementation.

504

Timeout

Double check your endpoint and tool requirements

Troubleshooting workflow

If you're experiencing issues with your custom SIEM integration, try this troubleshooting workflow:

  1. Check Event Subscription Status: Look for error messages in Material indicating why events might be failing or if subscriptions have been auto-disabled. For example:

  2. Verify Network Connectivity: Ensure Material can reach your SIEM endpoint and that firewall rules allow the connection. You may need to update TLS settings or SSL certificates

  3. Test with Simple Events First: Start with basic audit log events before moving to complex issue data to isolate where the integration breaks.

  4. Review SIEM-Specific Requirements:

    1. Splunk: May need specific source types and index configurations

    2. Chronicle/SecOps: Requires proper field mapping for extracted.fields

    3. Panther: Needs schema matching for event classification

FAQ

Why are my SIEM feeds failing?

Some common integration issues and solutions are:

Webhook Configuration Problems

  • Verify your webhook URL is correct and accessible

  • Check that your SIEM can accept the webhook payload format

  • Ensure proper authentication headers are configured

  • Test the webhook endpoint directly with a simple POST request

Event Subscription Setup

  • Confirm the event subscription is enabled and not disabled due to errors

  • Verify the correct event types are selected

  • Test with the Send Test Event button to isolate configuration issues (see Troubleshooting workflow)

Payload and Schema Issues

  • Verify your SIEM can parse Material's JSON payload format

  • Check for timestamp formatting conflicts (common with Splunk integrations)

  • Ensure the payload size doesn't exceed your SIEM's limits (64kB for SumoLogic)

  • Review if you need to customize the payload fields being sent

PreviousEmail Notifications
NextCrowdStrike NG-SIEM

Last updated

Was this helpful?