SIEM Integration

Netmaker can stream audit and network activity events to supported Security Information and Event Management (SIEM) platforms, enabling centralized monitoring, alerting, compliance reporting, and security investigations.

Supported SIEM platforms include:

• Datadog
• Splunk
• Microsoft Sentinel
• Elastic Security

Overview

The SIEM integration allows Netmaker to export platform events to an external security monitoring solution. Exported events can be correlated with logs and telemetry from other systems to provide greater visibility into network operations and administrative activity.

Configure a SIEM Integration

1. Navigate to Settings → Integrations.

1. Connect the desired SIEM provider.
2. Enter the provider-specific connection details and credentials.
3. Test the connection.
4. Save the integration.

Once configured, Netmaker will begin forwarding supported audit and activity events to the selected SIEM platform.

Provider-Specific Configuration

Refer to the following guides for configuration details:

Datadog

1. Create a Datadog API key

   
2. Enter the API key in Netmaker.

   
3. In the Datadog Site field, select the region/site where your Datadog organization is hosted.
4. If your Datadog URL is https://us5.datadoghq.com, select us5.datadoghq.com (US5) from the dropdown.

   
5. Test and save the integration.

   

Splunk

Step 1: Open HTTP Event Collector

1. Click Settings (top-right of the Splunk interface).

   
2. Select Data Inputs.

   
3. Click HTTP Event Collector.

   
4. If HEC is disabled, enable it under Global Settings.

   

   

Step 2: Create a HEC Token

1. Click New Token.

   
2. Give it a name, such as Netmaker SIEM.
3. Choose the destination index (for example, main).

   
4. Complete the wizard and click Submit.
5. Copy the generated HEC Token.

Step 3: Copy the HTTP Event Collector (HEC) Endpoint

Enter your Splunk Cloud instance URL as the HEC Endpoint URL.

For example, if your Splunk Cloud instance is:

https://prd-p-wvklf.splunkcloud.com

then enter:

https://prd-p-wvklf.splunkcloud.com

Step 4: Configure Netmaker

Enter the following values:

• HEC Endpoint URL

  https://http-inputs-prd-p-wvklf.splunkcloud.com/services/collector/event

• HEC Token

  • Paste the token you created in Splunk.
• Test and save the integration.

Microsoft Sentinel

1. Create a Data Collection Endpoint (DCE) and Data Collection Rule (DCR).
2. Obtain the ingestion endpoint and credentials.
3. Enter the endpoint and credentials in Netmaker.
4. Test and save the integration.

Elastic

1. Check if You Already Have a Deployment

• Go to https://cloud.elastic.co and log in
• On the home screen, check “Deployments”

If you already have a deployment:

• Skip to Step 3 (Open Deployment)

If you don’t have a deployment:

• Click “Create deployment” and continue below

---

2. Create a Deployment

Click “Create deployment”, then configure:

• Name: e.g. netmaker-security
• Cloud Provider: AWS / GCP / Azure
• Region: closest to your Netmaker instance
• Version: latest Elasticsearch
• Template: Security or General Purpose

Optional settings

• Adjust sizing/resources if needed (defaults are usually fine)

Finish setup

• Click “Create Deployment”
• Wait until status becomes Healthy
• IMPORTANT: Save credentials:

  • Username: elastic
  • Password (shown only once)

---

3. Open Your Deployment

• From the deployments list, click “Manage” on your deployment

  

---

4. Get Elasticsearch Endpoint

• In the deployment overview, locate:

  
• Click the copy icon

---

5. Create API Key (via Kibana)

Open project

• Click “Open project”

  

Create API key

• Click the Settings (⚙️) icon in the left sidebar

  
• Click API Keys

  
• Click “Create API key”

  
• Name: netmaker-integration
• Copy and save it immediately (it won’t be shown again)

---

6. Configure Netmaker Integration

Use the following values:

• Elasticsearch Endpoint
• API Key
• Index name (e.g. netmaker-events or custom)

---

7. Final Step

Enter these values into your Netmaker SIEM integration settings and save.

Verify the Integration

1. Click Test Connection.

   
2. Save the integration.
3. Generate a test event in Netmaker.
4. Confirm the event appears in your SIEM platform.