Send logs to your SIEM

Kilasec can deliver two streams straight from the cloud into the SIEM you already run:

• Security events: every AI request Kilasec made a decision on (allow, log, redact, tokenize, deny, approval), with who sent it, where it went, which rule matched and what was detected. This is the same data as Live Traffic.
• Admin audit log: every change made in the console (rules, users, settings, integrations, sign-ins). This is the same data as Logs → Audit.

Where you do this: Dashboard → Integrations → Add integration (kilasec.com/app/). Requires the tenant_admin role. Nothing runs on your collectors for this, because delivery happens from the Kilasec cloud.

How delivery works

• Nothing is dropped. Each integration tracks how far it has delivered. If your SIEM is down or rejects a batch, Kilasec keeps its place and retries the same records. Retries start 15 seconds after a failure and back off to at most every 15 minutes. When the SIEM is back, delivery continues from where it stopped. The card shows Failing since … with the SIEM's error while this is happening.
• At-least-once. After a retry, a record can arrive twice. Every record has a stable id, so deduplicate on it if exact counts matter.
• Starts from now. A new integration delivers what happens after you add it. Earlier history stays in Kilasec; export it from Live Traffic or Logs if you need it in the SIEM.
• Latency. Usually under 30 seconds.
• Retention limit. Records older than your event retention (default 90 days) are purged even if an integration is still failing. A SIEM that has been down for longer than that misses the purged part.
• Edits keep your place. Rotating a token or fixing a URL (the ✎ button) resumes from where delivery stopped. Removing an integration and adding it again starts from that moment.
• Test sends one sample of each selected stream through the real format and credentials, and shows the SIEM's exact error if it fails.

Delivery is outbound HTTPS from the Kilasec cloud. If your SIEM endpoint is IP-restricted, allow Kilasec's egress address (ask support). Endpoints must be public https:// URLs; private and internal addresses are refused.

Splunk

Uses the HTTP Event Collector (HEC).

1. In Splunk: Settings → Data inputs → HTTP Event Collector → New Token. Leave Enable indexer acknowledgement off. Pick the allowed index(es).
2. In Kilasec, add a Splunk integration:
   • HEC URL: the collector base, e.g. https://splunk.yourco.com:8088 (Splunk Cloud: https://http-inputs-<stack>.splunkcloud.com). Kilasec appends /services/collector/event.
   • HEC token: the token value.
   • Index (optional): leave blank to use the token's default.

Events arrive with sourcetype=kilasec:event and audit records with sourcetype=kilasec:audit, source=kilasec, and _time set to when the request happened. To try it:

index=<your index> sourcetype=kilasec:event decision=deny | stats count by user, destination, rule

Microsoft Sentinel

Uses the Azure Monitor Logs Ingestion API, the supported path for custom logs into a Log Analytics workspace.

1. Create a custom table Kilasec_CL in the workspace (Tables → Create → New custom log (DCR-based)). Use these columns:

   Column	Type
   TimeGenerated	datetime
   RecordType	string (event or audit)
   Id	string
   Tenant	string
   Decision	string
   Rule	string
   Agent	string
   User	string
   Device	string
   SourceIp	string
   Destination	string
   Action	string
   Actor	string
   Summary	string
   Data	dynamic (the full record, see below)

   The wizard creates a data collection endpoint (DCE) and a data collection rule (DCR) with an input stream named Custom-Kilasec_CL.

2. Register an app: Microsoft Entra ID → App registrations → New registration, then Certificates & secrets → New client secret.

3. Grant it access: on the DCR, Access control (IAM) → Add role assignment → Monitoring Metrics Publisher for that app.

4. In Kilasec, add a Microsoft Sentinel integration with:

   • the DCE's Logs ingestion URL
   • the DCR's Immutable ID (dcr-…, from its JSON view)
   • the stream (Custom-Kilasec_CL unless you named it differently)
   • the Directory (tenant) ID and Application (client) ID
   • the client secret

New role assignments can take a few minutes to apply. If Test returns HTTP 403 at first, wait a moment and test again. To try it:

Kilasec_CL | where RecordType == "event" and Decision == "deny" | summarize count() by User, Destination

Datadog

1. In Datadog: Organization Settings → API Keys → New Key.
2. In Kilasec, add a Datadog integration. Pick your site (datadoghq.com, datadoghq.eu, us3, us5, ap1, or ddog-gov.com) and paste the API key.

Records arrive as logs with source:kilasec, service:kilasec, a kilasec_type:event|audit tag, and the full record under the kilasec attribute. For example, search source:kilasec @kilasec.decision:deny.

Elastic

Uses the _bulk API.

1. In Kibana: Stack Management → API keys → Create API key, with create_doc and auto_configure privileges on the target index or data stream. Copy the Encoded value.
2. In Kilasec, add an Elastic integration:
   • Elasticsearch URL: e.g. https://my-deployment.es.us-east-1.aws.elastic.cloud
   • Index or data stream: default kilasec
   • API key: the encoded key

Each record is indexed with @timestamp. If Elasticsearch rejects a document (for example a mapping conflict), the batch counts as failed and the error is shown on the card. Documents already indexed by an earlier attempt are not treated as errors.

Any HTTPS endpoint

For Cribl, Sumo Logic, Chronicle forwarders, a Lambda, or your own pipeline. Kilasec POSTs JSON:

{ "source": "kilasec", "tenant": "t_…", "stream": "events", "count": 2, "records": [ … ] }

Set an optional auth header: the name (default Authorization) and its full value, e.g. Bearer abc123. Any 2xx reply counts as accepted; anything else is retried.

Slack

Slack is an alert channel, not a log sink. It posts a short message when blocked or redacted actions happen. It isn't retried, and it doesn't carry the admin audit log. Use one of the destinations above for a complete record.

Record reference

Field names are stable. New fields may be added, and existing ones are never renamed.

Security event (type: "event")

Field	Meaning
id	Unique event id (dedup key)
time / ts	When the request happened (ISO-8601 UTC / epoch seconds)
tenant	Your Kilasec workspace id
decision	allow, log, redact, tokenize, deny, require_approval
rule / reason	Matched policy rule and the human-readable reason
agent / action	The client (e.g. claude-cli, browser) and request kind
user / device / source_ip / principal_type	Who sent it
destination / model / tool	Where it went (AI host, model, MCP tool)
collector	Which collector saw it
detections	What content scanning found, as labels only, e.g. {"secret": ["aws_access_key"], "pii": ["email"]}. Values are never included.
count	How many identical clean requests this record stands for (repeats are folded)
duration_ms / flow_id	Decision latency; id linking to usage/cost

Admin audit (type: "audit"): id, time/ts, tenant, actor, actor_ip, action (e.g. rule.update, user.invite), target_kind, target_id, summary.

Prompt and response text is never sent. Kilasec doesn't keep it in the cloud unless you've opted in on your collector.