# kosa8 cloud siem add

Add a SIEM destination

--kind webhook     --url https://…  (a signing secret is printed once)
--kind splunk_hec  --url https://splunk…:8088/services/collector/event --token …
--kind datadog     --site datadoghq.com --api-key …

The token or API key may come from KOSA8_SIEM_TOKEN instead of a flag, to keep
it out of shell history. It is stored encrypted and never shown again.

## Flags

| Flag | Type | What it does | Default |
|---|---|---|---|
| `--api-key` | string | Datadog API key (or KOSA8_SIEM_TOKEN) |  |
| `--index` | string | Splunk index |  |
| `--kind` | string | webhook, splunk_hec or datadog | `webhook` |
| `--name` | string | a name for this destination |  |
| `--site` | string | Datadog site, e.g. datadoghq.com or datadoghq.eu |  |
| `--sourcetype` | string | Splunk sourcetype (default ocsf:api_activity) |  |
| `--start` | string | beginning (send the whole log first, the default) or now |  |
| `--token` | string | Splunk HEC token (or KOSA8_SIEM_TOKEN) |  |
| `--url` | string | https address (webhook, splunk_hec) |  |

## Example

```
  kosa8 cloud siem add --kind splunk_hec --url https://splunk.acme.com:8088/services/collector/event --index security
  kosa8 cloud siem add --kind datadog --site datadoghq.eu --start now
```

---
Source: https://docs.kosa8.com/reference/cloud-siem-add/