> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/custom-connector.md).

# Custom connector

DoControl allows you to create SIEM and SOAR connectors. You can send these DoControl entities to your organization's consolidated event management system for further investigation, data aggregation, and monitoring:

* **Alerts** - Investigate alerts in your SIEM and remediate in the DoControl platform when necessary.
* **Workflows** - A JSON structured log is sent to the SIEM, containing a synthetic high-level summary of each workflow execution. The log includes the workflow name, actor, event type, app, execution duration, and execution path.
* **SaaS events** -  Select the relevant app and event types to send to your SIEM.

{% hint style="warning" %}

* Sending events and workflows to your SIEM increases the volume of generated logs and might impact your SIEM cost.
* DoControl sends logs for event-triggered workflows only, not for on-demand, scheduled, or alert-triggered workflows.
  {% endhint %}

To push DoControl data downstream to a custom pipeline and display them in the collection board, you need to:

1. In DoControl, click **Settings** <img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FWkfN1O2BKZBlrnVXQ5Wu%2Fsettings%20icon.png?alt=media&amp;token=9336f06e-7a3c-4651-97c7-a1ccd2cbface" alt="" data-size="line"> from the top-right corner in any screen.

2. Navigate to **Connectors > SIEM and SOAR connectors > Custom**.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FQlHzvtpAgqqCOi9oupyd%2Fcustom%20connector.png?alt=media&amp;token=450eabff-4c75-4cde-b389-acd59de18ec6" alt=""><figcaption><p>Defining a SIEM connector for sending DoControl alerts and events to a custom SIEM or SOAR solution<br></p></figcaption></figure>

3. Enter the **connector display name**.

4. In your custom connector, generate the HTTPS event connector, which is the destination URL of your event collector with https protocol.

5. Enter the **HTTPS event connector**.

6. **Optional**: Enter custom header keys and values.\
   HTTP headers can be authorization tokens that provide attribution information, or authenticate with your custom connector.

7. Click **Add** to enter additional header keys and values.

8. Select the DoControl data types to send to your custom connector:
   * Alerts
   * SaaS events
   * Workflows<br>

     <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FKmz4cvknYwQV0Zjx0Hze%2Fcustom%20connector%20data%20types.png?alt=media&amp;token=340ebd0a-3b90-49f5-89f6-40cd57657ebd" alt=""><figcaption></figcaption></figure></div>

9. For SaaS events, select the relevant **app** and **event types**.

10. For **workflows**, select the relevant workflows and execution status.\
    You can select between 1 and 100 event-triggered workflows.&#x20;

    1. To send all your workflows to your SIEM, click **Select all**.&#x20;
    2. Select the relevant execution status: Completed, Warning, Failed, Cancelled or Timed out.<br>

       <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FB3mHmn9B5RFqBWNbG0YE%2FWFs%20to%20custom%20connector.png?alt=media&amp;token=5ab5b16f-fa64-447c-8ba9-e4ebf899ada3" alt="" width="459"><figcaption></figcaption></figure></div>

11. Click **Add app** to send events from another integrated app.

12. Click **Test & Save**.

13. If you wish to edit the connector, make any changes and click **Test & Save**.

{% hint style="success" %}
Once you're connected to your custom connector, you'll receive a success message as confirmation:\
\
**Success!**

Your custom connection is all set up. DoControl alerts, workflows and events are now being pushed downstream to the centralized log of your custom connector.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/connectors/siem-and-soar-connectors/custom-connector.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.