Export Security Incidents to a SIEM

Tasks

Send an incident, with its MITRE ATLAS and ATT&CK techniques and tactics, triage state and recommended action, to one or more SIEMs as an OCSF Detection Finding.

Before you start

• You need the admin role to configure destinations and to export.
• For OCSF JSON and Splunk HEC, create an HTTPS endpoint that accepts a JSON POST for each destination. Amazon Security Lake and Microsoft Sentinel have no generic endpoint; see the Security Lake guide and the Sentinel guide. For Splunk, create an HTTP Event Collector token. A plain http:// URL is accepted only for a loopback address. The URL cannot contain a query string, fragment or user info. Put credentials in the token.
• Know which data leaves the product. See what is never exported: evidence content and triage notes are never sent, and finding summaries are sent only to a destination where you turn on Include finding summaries. A summary can contain matched content; credentials and personal data are redacted first, and everything else is sent as is.

Configure the destinations

1. Go to Integrations → Security export and select Add destination. You can add up to 10.
2. Enter a unique Name and the Endpoint URL. The URL is hidden after you save; enter a new one to change it. For Amazon Security Lake or Microsoft Sentinel, choose that Format first and follow the Security Lake guide or the Sentinel guide; there is no generic endpoint.
3. Choose the Format. Use OCSF JSON for a generic receiver. Use Splunk HEC for the HTTP Event Collector, and optionally set the sourcetype and index.
4. Set a Token. It is required for Splunk HEC and optional for OCSF JSON. It is sent as Authorization: Bearer, or as Authorization: Splunk for Splunk HEC. Optionally set a Signing secret to add an X-AIControls-Signature HMAC-SHA256 header that your receiver can verify.
5. Choose where incidents go. The Severity filter and optional Event types decide which incidents this destination receives from Export to all and from automatic export.
6. Choose Automatic export. The default is Off. When you turn it on without a severity filter, only critical incidents are sent.
7. Optionally turn on Redact actors to leave user, agent and assignee identities out of the payload, or Include finding summaries to add summaries after credentials and personal data are redacted. Both are off by default.
8. Turn the integration on, select Send Test, then Save. The test sends a synthetic event labeled trigger:test to every endpoint destination and exports no real incident. For an Amazon Security Lake destination it assumes the role and writes one empty Parquet object instead.

Export an incident

1. Go to Security → Activity → Correlated findings and open an incident.
2. Choose All matching destinations or one destination, then select Export incident. The drawer shows when and by whom the incident was last exported to each destination. A viewer sees that line but not the button.

The first export of an incident to a destination is a Create event. A later export is an Update, and exporting again after the incident is resolved sends a Close event with the verdict. They share one finding_info.uid, the incident ID, so your SIEM can correlate them. Exporting to a destination you choose by name ignores its filters.

Exporting the same incident to the same destination again within 2 minutes is refused, so two administrators cannot send a duplicate. If one destination does not accept the event, the others still receive it and the drawer names the one that failed. The product retries transient failures before it reports one.

If the incident already has a Jira or ServiceNow ticket, the event carries it in tickets. Updates and close events are not sent automatically when you acknowledge, assign or resolve an incident; export again to send them.

Export incidents automatically

With Automatic export on, every few minutes the product sends each open incident seen in the last 24 hours that is at or above the destination's severity (critical when no filter is set) and matches its event types, if it has not been sent there. Each incident is sent once per destination across all replicas, and one you already exported by hand is skipped. A failed delivery is retried on the next run until the incident leaves the 24-hour window. Automatic events carry a stable metadata.uid, so a receiver that deduplicates on it drops any repeat.

Check what was sent

Every attempt is recorded in Security → Activity → Configuration as security_incident.exported, with the actor (system for automatic exports), the trigger, the destination name and host, the event ID, the attempt count, and whether it succeeded. Credentials, URL paths and payloads are not recorded. Scrape aicontrols_security_export_total to alert on failures.

Other receivers

Receiver	How to connect
Splunk	Use the Splunk HEC format.
Elastic, Datadog, or a custom collector	Use OCSF JSON. Add authentication with the token or signing secret.
Microsoft Sentinel	Use the Microsoft Sentinel (Logs Ingestion) format. AIControls gets the Microsoft Entra token itself. See Export security incidents to Microsoft Sentinel.
Amazon Security Lake	Use the Amazon Security Lake (Parquet) format. See Export security incidents to Amazon Security Lake.
Jira or ServiceNow	Not part of this integration. Use Create Jira and ServiceNow tickets.

See Security Incident OCSF Mapping for every exported field.