Commands / kosa8 cloud siem

`kosa8 cloud siem`

Stream the audit log to a SIEM (webhook, Splunk HEC, Datadog)

Every audit event, as OCSF API Activity (class_uid 6003) JSON, sent in order within about a minute, retried with growing gaps if the destination fails. Owners and admins only.

Subcommands

kosa8 cloud siem addAdd a SIEM destination kosa8 cloud siem lsList SIEM destinations kosa8 cloud siem rmStop streaming to a destination kosa8 cloud siem testSend one test event to a destination now