# kosa8 cloud siem

Stream the audit log to a SIEM (webhook, Splunk HEC, Datadog)

Every audit event, as OCSF API Activity (class_uid 6003) JSON, sent in order
within about a minute, retried with growing gaps if the destination fails.
Owners and admins only.

## Subcommands

- [`kosa8 cloud siem add`](https://docs.kosa8.com/reference/cloud-siem-add.md): Add a SIEM destination
- [`kosa8 cloud siem ls`](https://docs.kosa8.com/reference/cloud-siem-ls.md): List SIEM destinations
- [`kosa8 cloud siem rm`](https://docs.kosa8.com/reference/cloud-siem-rm.md): Stop streaming to a destination
- [`kosa8 cloud siem test`](https://docs.kosa8.com/reference/cloud-siem-test.md): Send one test event to a destination now

---
Source: https://docs.kosa8.com/reference/cloud-siem/