Live SIEM

How the SIEM Engine Works

GuardFox Security Systems ingests security events from up to 10 data sources simultaneously. All events are normalised into the SIEMEvent schema before storage, which enables cross-source correlation and pivot analysis.

Ingestion flow:

1. Source sends data to POST /api/siem/ingest (webhook) or GuardFox Security Systems polls the source API
2. Events are parsed and normalised — fields mapped to: user, host, srcIp, message, eventId, timestamp, category
3. Events are stored in PostgreSQL via Prisma
4. If an event matches a SOAR trigger rule, the playbook engine fires
5. AI root-cause analysis runs on correlated event clusters

Supported connectors:

• Syslog (UDP/514)
• Wazuh (webhook)
• CrowdStrike Falcon (API stream)
• AWS CloudTrail + GuardDuty
• Okta Identity Events
• Microsoft 365 / Azure AD
• Palo Alto Panorama
• Generic webhook (JSON)
• EDR agent events (internal)

Connecting a Data Source

Step 1 — Go to Administration → Data Sources

Each connector has a unique webhook URL and optional API key.

Step 2 — Configure your source

Syslog (UDP)

Host: portal.guardfoxsecurity.com
Port: 5140
Protocol: UDP
Format: RFC 5424 or RFC 3164

Wazuh

In /var/ossec/etc/ossec.conf, add an integration block:

<integration>
  <name>custom-webhook</name>
  <hook_url>https://portal.guardfoxsecurity.com/api/siem/ingest</hook_url>
  <alert_format>json</alert_format>
</integration>

CrowdStrike

In the Falcon console: Settings → Integrations → SIEM Connector

• Protocol: HTTPS
• URL: https://portal.guardfoxsecurity.com/api/siem/ingest
• Format: JSON

Generic webhook

POST JSON to /api/siem/ingest with header X-GuardFoxKey: YOUR_INGEST_KEY.

Using the Live SIEM

Event stream

The main view shows a real-time event stream with auto-refresh every 10 seconds. Events are colour-coded by severity.

Root-cause pivot

Click any IP, hostname, or username to pivot — the SIEM immediately filters to all events involving that entity across all sources and time.

AI root-cause summary

Click the AI Analyse button on any event cluster to generate a natural-language narrative explaining the sequence of events, likely attack technique, and recommended actions.

Filters

• Source — filter to one connector
• Category — Authentication, Network, Endpoint, Policy
• Time range — last 1h / 6h / 24h / 7d / custom
• Severity — Critical, High, Medium, Low, Info

Export

Click Export CSV to download the current filtered view. Useful for offline analysis or sharing with stakeholders.

Data retention

Each organization has a configurable retention window (Organization → Settings, default 90 days). Enforcement isn't just a filter on old data — a scheduled background job actually deletes SIEM events and alerts older than the configured window, running 60 seconds after the server starts and then once every 24 hours. To run it manually (e.g. from an external cron instead of relying on the built-in schedule), use npm run db:enforce-retention.