# SIEM integration

> Receive Ironchip events in your SIEM: Ironchip sends them as JSON over HTTPS, and rsyslog forwards them over syslog to QRadar, Splunk, Sentinel, or another.

URL: https://docs.ironchip.com/en/identidad/administracion/integracion-siem/

This page explains how to bring your company's Ironchip events into your SIEM: how Ironchip sends them and how to receive them with rsyslog and forward them over syslog. It is for whoever administers the platform and the SIEM.

## How it works

1. Ironchip sends each event of your company as a JSON object in a `POST` request over HTTPS to an address of yours.
2. In your network, rsyslog receives those requests with its HTTP input module (`imhttp`).
3. rsyslog forwards each event over syslog to your SIEM, which treats it like any other source.

If your SIEM has its own HTTP collector, it can receive the events directly, without rsyslog.

The integration is available in the Enterprise and Premium tiers. In Premium, in addition to the authentication events, the SIEM receives the [ITDR](https://docs.ironchip.com/en/identidad/administracion/itdr/) alerts. See [Enterprise and Premium](https://docs.ironchip.com/en/faq/#what-is-the-difference-between-the-enterprise-and-premium-tiers-in-siem-integration).

## Turn it on

The Ironchip team turns it on for your company. Request it in **Monitoring > SIEM integration** or from your Ironchip contact, with these details:

| Detail            | Example                                        | What it is for                                                           |
| ----------------- | ---------------------------------------------- | ------------------------------------------------------------------------ |
| Receiving address | `https://siem-relay.example.com:8443/ironchip` | Where Ironchip sends the events. It must be reachable from the internet. |
| Headers           | `Authorization: ApiKey <TOKEN>`                | What Ironchip uses to identify itself to your receiver.                  |
| Events            | Authentications and ITDR alerts                | Which events you want to receive.                                        |

Use a valid TLS certificate on the receiving address, and a long, random token used only for this integration.

## Receive the events with rsyslog

This reference configuration receives the events over HTTPS, checks the token, and forwards them over syslog to your SIEM. It has been tested with rsyslog 8.2610 (the official `rsyslog/rsyslog` image) behind nginx. Adapt it to your environment.

- **rsyslog** needs the `imhttp` HTTP input module. It listens on localhost only, without TLS.
- **A reverse proxy** (nginx in the example, or the load balancer you already use) terminates HTTPS with your certificate and passes the requests to rsyslog.

1. Save the token you agreed on with Ironchip in `/etc/rsyslog/imhttp-apikeys`, with `600` permissions.
2. Create `/etc/rsyslog.d/ironchip.conf`:

   ```ini title="/etc/rsyslog.d/ironchip.conf"
   # HTTP intake on localhost only: the reverse proxy terminates HTTPS in front
   module(load="imhttp" ports="127.0.0.1:8080")

   input(type="imhttp" endpoint="/ironchip" name="ironchip"
         ruleset="ironchip" apiKeyFile="/etc/rsyslog/imhttp-apikeys")

   # RFC 5424 syslog with "ironchip" as the application; the message is the event JSON
   template(name="IronchipRFC5424" type="string"
            string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %$myhostname% ironchip - - - %msg%\n")

   ruleset(name="ironchip") {
     action(type="omfwd" target="siem.example.com" port="514" protocol="tcp"
            template="IronchipRFC5424")
   }
   ```

3. Publish the address over HTTPS on the reverse proxy. With nginx:

   ```nginx title="/etc/nginx/conf.d/ironchip-siem.conf"
   server {
       listen 8443 ssl;
       server_name siem-relay.example.com;
       ssl_certificate     /etc/nginx/tls/siem-relay.crt;
       ssl_certificate_key /etc/nginx/tls/siem-relay.key;

       location = /ironchip {
           proxy_pass http://127.0.0.1:8080;
       }
   }
   ```

4. Restart both services:

   ```bash
   sudo systemctl restart rsyslog nginx
   ```

5. Check that it receives and forwards events, with a test event:

   ```bash
   curl -H 'Authorization: ApiKey <TOKEN>' \
        -d '{"type":"test","message":"Ironchip test"}' \
        https://siem-relay.example.com:8443/ironchip
   ```

   The response is `200`, and a line like this one reaches your SIEM:

   ```text
   <13>1 2026-10-29T17:56:04.134194+00:00 siem-relay ironchip - - - {"type":"test","message":"Ironchip test"}
   ```

:::tip[Encrypted forwarding to the SIEM]
If your SIEM accepts syslog over TLS (usually on port 6514), configure `omfwd` with `StreamDriver="gtls"` and `StreamDriverMode="1"` and use that port. See the rsyslog documentation on TLS.
:::

`imhttp` splits messages on line breaks, and each Ironchip event arrives on a single line of JSON, so each event is one message. Without the correct token, rsyslog responds `401` and forwards nothing.

## In your SIEM

- Create a syslog source for the receiving rsyslog, and identify the Ironchip events by the `ironchip` application.
- The content is JSON: use your SIEM's JSON parser to extract its fields (event type, user, application, result, IP address...).
- Some SIEMs, such as IBM QRadar, identify the source by the address the syslog comes from, not by its header: in that case, all Ironchip events arrive from the receiving rsyslog.

## Troubleshooting

| Symptom                                                     | What to do                                                                                            |
| ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| The `curl` test returns `401`                               | The token in the header does not match the one in `imhttp-apikeys`.                                   |
| The `curl` test returns `502`                               | rsyslog is not listening on `127.0.0.1:8080`: check that it loads `imhttp` (`journalctl -u rsyslog`). |
| The test works, but nothing arrives from Ironchip           | Check that the address is reachable from the internet and that its certificate is valid.              |
| Events arrive, but the SIEM does not split them into fields | Turn on JSON parsing of the message in the Ironchip source.                                           |

## More information

- [ITDR event export](https://docs.ironchip.com/en/identidad/administracion/exportacion-de-eventos/): export events to a file from the console.
- [Activity and metrics](https://docs.ironchip.com/en/identidad/administracion/monitorizacion/)