SIEM: pull with the OCSF API

The pull option: your SIEM asks Sentilai for events on its own schedule.

The endpoint

GET /api/siem/v1/events?cursor=&limit=1000

Events are in OCSF — the Open Cybersecurity Schema Framework — so they land in a shape Splunk, Microsoft Sentinel, Elastic and QRadar already understand.

Authentication

An API credential with the audit:read scope. Create it on API Credentials; the secret is shown exactly once.

Give this credential only audit:read. It is going to live in a configuration file in another system, and it should be able to do nothing except read audit events.

Cursor pagination

Each response carries a cursor. Store it, pass it next time, get what has happened since. This is what makes the integration resumable: a SIEM that was down for a day catches up rather than losing the gap.

Choosing pull or push

Pull is more reliable — your SIEM controls the pace and can retry. It is the default recommendation.

Push is lower-latency and suits SIEMs that prefer to receive syslog. See SIEM: push over syslog.

You can run both.