SIEM Integration

Stream real-time security events to your SIEM for centralized monitoring and compliance.

Supported Integrations

Configuration

1. Go to External Config in the dashboard.
2. Enable SIEM Integration.
3. Enter your platform's API key or HEC token.
4. Test Connection before saving.

Event Types

Edison Watch streams per-session activity:

• Tool Calls: Metadata for every action (timestamp, user, tool name, duration).
• Security Events: Flag changes (Trifecta) and ACL violations.
• Approvals: Audit records of human-in-the-loop decisions.
• Admin Actions: Configuration changes and user role updates.

Common Event Format (CEF)

For legacy SIEMs, Edison supports CEF over HTTP:

CEF:0|Edison Watch|Edison Watch|1.0|tool_call|Tool Call|5|[email protected] act=filesystem.read_file outcome=success

Performance & Reliability

• Asynchronous: Log streaming does not add latency to AI tool calls (<1ms overhead).
• Batching: Events are flushed every 10 seconds or when the buffer hits 100 events.
• Retries: 3 attempts with exponential backoff; events are buffered during network outages.