> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors.md).
# SIEM and SOAR connectors
Security teams usually consolidate their organization's incident and response operation in a single security information and event management (SIEM) system, or in a security orchestration, automation and response (SOAR) platform.
DoControl allows you to create SIEM and SOAR connectors. You can send these DoControl entities to your organization's consolidated event management system for further investigation, data aggregation, and monitoring:
* **Alerts** - Investigate alerts in your SIEM and remediate in the DoControl platform when necessary.
* **Workflows** - A JSON structured log is sent to the SIEM, containing a synthetic high-level summary of each workflow execution. The log includes the workflow name, actor, event type, app, execution duration, and execution path.
* **SaaS events** - Select the relevant app and event types to send to your SIEM.
You can push DoControl data downstream for these SIEM connectors, where DoControl alerts, workflows and events are displayed in their respective collection boards. Alternatively, you can add your own custom connector:
* [Sumo Logic](/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/sumo-logic.md)
* [Datadog](/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/datadog.md)
* [Splunk](/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/splunk.md)
* [Custom connector](/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/custom-connector.md)
{% hint style="warning" %}
* Sending events and workflows to your SIEM increases the volume of generated logs and might impact your SIEM cost.
* DoControl sends logs for event-triggered workflows only, not for on-demand, scheduled, or alert-triggered workflows.
{% endhint %}
## Raw alert data
Following is an example of raw alert data that DoControl sends to a SIEM via a connector:
```
{
app: "GOOGLE_DRIVE",
severity: "HIGH",
statusInfo: {
changedByLastName: "Doe",
changedByFirstName: "John",
changeDate: "2024-11-21T15:56:19.629Z",
changedByEmail: "support@dotontrol.io",
},
alertLink: "https://app.docontrol.io/alerts/active?alertId=554034",
threshold: "LOW",
totalAssetsNumber: 3,
alertSystemCreationDate: "2024-11-21 15:56:17 UTC+00:00",
targets: "Public Sharing",
actor: {
userType: "INTERNAL",
department: "R&D",
employmentStatus: "TERMINATED",
roleInOtherSaas: [
{
app: "SLACK",
roleInSaas: ["Full member"],
},
],
email: "riskyuser@docontrol.io",
linkedinTitle: "Backend Developer",
},
emailDescription:
'Internal user, riskyuser@docontrol.io, publicly shared 1 sensitive file including "Really secret contract". Sensitive keywords were detected in the file name, or a user-defined keyword was detected.',
companyId: "ca56e1-e58b-434d-b181-01b042e84a5a",
alertConfigId: 6,
indicativeAsset: {
triggeringSensitiveKeywords: ["Contract", "secret"],
assetId: "1C19R1N2ITq7EQqlAgiNSVPsgTg5KEOVP2O67I",
link: "https://docs.google.com/document/d/1C3RaE87EQqlAgiNSVPsgTg5KEOVP2O67I",
assetName: "Really secret contract",
},
name: "Public sharing of sensitive files",
alertId: "554034",
lifeCycle: {
firstName: "John",
lastName: "Doe",
email: "support@dotontrol.io",
updatedAt: "2024-11-21T15:56:19.629Z",
status: "NEW",
},
alertCategory: "PUBLIC_SHARING",
alertCreationDay: "2024-11-21",
status: "ACTIVE",
}
```
## Workflow log
Following is an example of a structured log that DoControl sends to a SIEM via a connector. The synthetic high-level summary of each workflow execution includes the workflow name, actor, event type, app, execution duration, and execution path.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
