Commands / kosa8 cloud siem add
kosa8 cloud siem add
Add a SIEM destination
--kind webhook --url https://… (a signing secret is printed once) --kind splunk_hec --url https://splunk…:8088/services/collector/event --token … --kind datadog --site datadoghq.com --api-key …
The token or API key may come from KOSA8_SIEM_TOKEN instead of a flag, to keep it out of shell history. It is stored encrypted and never shown again.
Options
| Flag | Type | What it does | Default |
|---|---|---|---|
--api-key | string | Datadog API key (or KOSA8_SIEM_TOKEN) | — |
--index | string | Splunk index | — |
--kind | string | webhook, splunk_hec or datadog | webhook |
--name | string | a name for this destination | — |
--site | string | Datadog site, e.g. datadoghq.com or datadoghq.eu | — |
--sourcetype | string | Splunk sourcetype (default ocsf:api_activity) | — |
--start | string | beginning (send the whole log first, the default) or now | — |
--token | string | Splunk HEC token (or KOSA8_SIEM_TOKEN) | — |
--url | string | https address (webhook, splunk_hec) | — |
Example
kosa8 cloud siem add --kind splunk_hec --url https://splunk.acme.com:8088/services/collector/event --index security kosa8 cloud siem add --kind datadog --site datadoghq.eu --start now