SIEM Connector

The Synqly SIEM provider connects your application to your customers' SIEMs. Synqly supports writing and querying events to and from SIEMs.

API Reference

For full API documentation see the SIEM API Reference.

To create an integration with the SIEM connector, use the Create Integration API endpoint, using one of the provider configs below.

API	CrowdStrike SIEM	Elasticsearch	Google Security Operations (Chronicle Compatibility)	Google Security Operations	SIEM Test	OpenSearch	IBM QRadar	Rapid7 InsightIDR	Microsoft Sentinel	Splunk	Sumo Logic Cloud SIEM
post_events	✅	✅	✅	✅	✅	✅	✅	❌	✅	✅	✅
query_events	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅
get_evidence	❌	❌	✅	❌	❌	❌	❌	✅	❌	❌	❌
get_investigation	❌	❌	✅	❌	❌	❌	✅	✅	✅	❌	✅
patch_investigation	❌	❌	❌	❌	❌	❌	❌	✅	✅	❌	✅
query_investigations	❌	❌	✅	❌	❌	❌	✅	✅	✅	❌	✅
query_log_providers	✅	✅	✅	✅	❌	✅	✅	✅	✅	✅	✅

API	CrowdStrike SIEM	Elasticsearch	Google Security Operations (Chronicle Compatibility)	Google Security Operations	SIEM Test	OpenSearch	IBM QRadar	Rapid7 InsightIDR	Microsoft Sentinel	Splunk	Sumo Logic Cloud SIEM
query_events	✅ [docs]	✅ [docs]	✅ [docs]	✅ [docs]	❌	✅ [docs]	✅ [docs]	✅ [docs]	✅ [docs]	✅ [docs]	✅ [docs]
query_investigations	❌	❌	❌	❌	❌	❌	✅ [docs]	✅ [docs]	❌	❌	✅ [docs]