SIEM Integrations

VNetArmor logs can be forwarded to SIEM and analytics tools. Common targets include Splunk, Elastic, Loki, and webhook collectors.

Event fields to preserve

• Timestamp.
• Request ID.
• Client IP.
• Host and path.
• Module decision.
• Action.
• Rule ID.
• Status code.
• Backend/pool name.
• Reason.

Best practices

• Forward JSON events where possible.
• Redact sensitive values before forwarding.
• Use stable index names and source types.
• Build dashboards for blocks, rate limits, backend errors, and top attacked paths.