SIEM integration

This page explains how to bring your company’s Ironchip events into your SIEM: how Ironchip sends them and how to receive them with rsyslog and forward them over syslog. It is for whoever administers the platform and the SIEM.

How it works

1. Ironchip sends each event of your company as a JSON object in a POST request over HTTPS to an address of yours.
2. In your network, rsyslog receives those requests with its HTTP input module (imhttp).
3. rsyslog forwards each event over syslog to your SIEM, which treats it like any other source.

If your SIEM has its own HTTP collector, it can receive the events directly, without rsyslog.

The integration is available in the Enterprise and Premium tiers. In Premium, in addition to the authentication events, the SIEM receives the ITDR alerts. See Enterprise and Premium.

Turn it on

The Ironchip team turns it on for your company. Request it in Monitoring > SIEM integration or from your Ironchip contact, with these details:

Detail	Example	What it is for
Receiving address	https://siem-relay.example.com:8443/ironchip	Where Ironchip sends the events. It must be reachable from the internet.
Headers	Authorization: ApiKey <TOKEN>	What Ironchip uses to identify itself to your receiver.
Events	Authentications and ITDR alerts	Which events you want to receive.

Use a valid TLS certificate on the receiving address, and a long, random token used only for this integration.

Receive the events with rsyslog

This reference configuration receives the events over HTTPS, checks the token, and forwards them over syslog to your SIEM. It has been tested with rsyslog 8.2610 (the official rsyslog/rsyslog image) behind nginx. Adapt it to your environment.

• rsyslog needs the imhttp HTTP input module. It listens on localhost only, without TLS.
• A reverse proxy (nginx in the example, or the load balancer you already use) terminates HTTPS with your certificate and passes the requests to rsyslog.

1. Save the token you agreed on with Ironchip in /etc/rsyslog/imhttp-apikeys, with 600 permissions.

2. Create /etc/rsyslog.d/ironchip.conf:

   /etc/rsyslog.d/ironchip.conf

   # HTTP intake on localhost only: the reverse proxy terminates HTTPS in front
   module(load="imhttp" ports="127.0.0.1:8080")
   
   input(type="imhttp" endpoint="/ironchip" name="ironchip"
         ruleset="ironchip" apiKeyFile="/etc/rsyslog/imhttp-apikeys")
   
   # RFC 5424 syslog with "ironchip" as the application; the message is the event JSON
   template(name="IronchipRFC5424" type="string"
            string="<%PRI%>1 %TIMESTAMP:::date-rfc3339% %$myhostname% ironchip - - - %msg%\n")
   
   ruleset(name="ironchip") {
     action(type="omfwd" target="siem.example.com" port="514" protocol="tcp"
            template="IronchipRFC5424")
   }

3. Publish the address over HTTPS on the reverse proxy. With nginx:

   /etc/nginx/conf.d/ironchip-siem.conf

   server {
       listen 8443 ssl;
       server_name siem-relay.example.com;
       ssl_certificate     /etc/nginx/tls/siem-relay.crt;
       ssl_certificate_key /etc/nginx/tls/siem-relay.key;
   
       location = /ironchip {
           proxy_pass http://127.0.0.1:8080;
       }
   }

4. Restart both services:

   sudo systemctl restart rsyslog nginx

5. Check that it receives and forwards events, with a test event:

   curl -H 'Authorization: ApiKey <TOKEN>' \
        -d '{"type":"test","message":"Ironchip test"}' \
        https://siem-relay.example.com:8443/ironchip

   The response is 200, and a line like this one reaches your SIEM:

   <13>1 2026-10-29T17:56:04.134194+00:00 siem-relay ironchip - - - {"type":"test","message":"Ironchip test"}

Encrypted forwarding to the SIEM

If your SIEM accepts syslog over TLS (usually on port 6514), configure omfwd with StreamDriver="gtls" and StreamDriverMode="1" and use that port. See the rsyslog documentation on TLS.

imhttp splits messages on line breaks, and each Ironchip event arrives on a single line of JSON, so each event is one message. Without the correct token, rsyslog responds 401 and forwards nothing.

In your SIEM

• Create a syslog source for the receiving rsyslog, and identify the Ironchip events by the ironchip application.
• The content is JSON: use your SIEM’s JSON parser to extract its fields (event type, user, application, result, IP address…).
• Some SIEMs, such as IBM QRadar, identify the source by the address the syslog comes from, not by its header: in that case, all Ironchip events arrive from the receiving rsyslog.

Troubleshooting

Symptom	What to do
The curl test returns 401	The token in the header does not match the one in imhttp-apikeys.
The curl test returns 502	rsyslog is not listening on 127.0.0.1:8080: check that it loads imhttp (journalctl -u rsyslog).
The test works, but nothing arrives from Ironchip	Check that the address is reachable from the internet and that its certificate is valid.
Events arrive, but the SIEM does not split them into fields	Turn on JSON parsing of the message in the Ironchip source.

More information

• ITDR event export: export events to a file from the console.
• Activity and metrics