SIEM & IDS/IPS Integrations

Export structured attack telemetry to 8 security platforms: Splunk, Elasticsearch, Microsoft Sentinel, Syslog CEF, Wazuh, MISP, Suricata, and Zeek

Overview

Flowtriq can export structured attack event data to your existing security tooling in real time. Each integration fires when an attack incident opens, updates on escalation, and fires again on resolution — giving your SIEM a complete attack lifecycle record.

Configure integrations from Dashboard → Integrations → SIEM.

Supported Destinations

Destination	Protocol	Format	Trigger
Splunk HEC	HTTPS POST	JSON event	Real-time on attack open/update/close
Elasticsearch	HTTPS PUT	JSON document	Real-time index write
Microsoft Sentinel	HTTPS POST	DCR / Log Analytics API	Real-time on attack open/update/close
Syslog (CEF)	UDP/TCP Syslog	CEF 0.1	Real-time on attack open/update/close
Wazuh	TCP / REST API	JSON log	Real-time agent event
MISP	HTTPS REST	MISP event + attributes	On attack open (IOC enrichment)
Suricata	File feed	Suricata rules (.rules)	Scheduled export feed
Zeek	File feed	Zeek Intel Framework	Scheduled export feed

Splunk HEC

Events are pushed to the Splunk HTTP Event Collector in real time. Each event includes the full incident payload:

{
  "time":       1716998657,
  "sourcetype": "flowtriq:attack",
  "source":     "flowtriq",
  "host":       "nyc-edge-01",
  "event": {
    "incident_id":   "inc_a3f7c2b1",
    "node":          "nyc-edge-01",
    "attack_family": "udp_flood",
    "peak_pps":      47821,
    "peak_bps":      1740000000,
    "confidence":   0.91,
    "src_ip_count": 3241,
    "spoofed":       true,
    "status":        "open"
  }
}

Configure with your HEC endpoint URL and token. Supports custom index and source type overrides.

Elasticsearch

Events are indexed as JSON documents. The index name is configurable (default: flowtriq-attacks). Each document uses the incident ID as the document ID, so updates overwrite the same document rather than creating duplicates.

Supports both self-hosted Elasticsearch and Elastic Cloud (set the cloud endpoint and API key).

Microsoft Sentinel

Events are sent to a custom Log Analytics table via the Azure Monitor Ingestion API (DCR-based). Requires a Data Collection Rule (DCR) and Data Collection Endpoint (DCE) configured in your Azure tenant.

See the Azure Monitor Ingestion API docs for DCR/DCE setup. Flowtriq only needs the DCE endpoint URL, DCR immutable ID, and a service principal client ID + secret.

Syslog CEF

Events are formatted as ArcSight Common Event Format (CEF) v0.1 and sent to your syslog receiver over UDP or TCP. CEF format is natively parsed by most SIEMs.

CEF:0|Flowtriq|FlowtriqDDoS|1.0|ATTACK_OPEN|DDoS Attack Detected|7|
src=203.0.113.5 dst=192.0.2.1 proto=UDP
cn1=47821 cn1Label=peakPPS cn2=1740000000 cn2Label=peakBPS
cs1=udp_flood cs1Label=attackFamily cs2=0.91 cs2Label=confidence

Wazuh

Events are sent as JSON log entries to the Wazuh manager via its REST API or as agent events. Custom Wazuh rules for Flowtriq event decoding are available in the integration panel.

MISP

When an attack opens, Flowtriq creates a MISP event with:

Attack family and confidence as event tags
Source IPs as ip-src attributes (if available)
Target IP as ip-dst attribute
Attack timestamp, peak PPS/BPS as free-text attributes
Threat level mapped from attack severity

Requires your MISP instance URL and an automation key with event write permissions.

Suricata & Zeek Export Feeds

Flowtriq generates rule/intelligence feeds that Suricata and Zeek can consume on a schedule:

Suricata: A .rules file containing drop rules for known attack source IPs (sourced from your incident history and threat intel feeds). Updated every 15 minutes. Configure Suricata to reload with suricatasc -c reload-rules.
Zeek: An Intel Framework compatible file in Zeek's tab-separated format (Intel::ADDR type), updated every 15 minutes. Drop in your Zeek intel directory and it loads automatically on the next rotation.

Feed URLs are available in Dashboard → Integrations → SIEM → Export Feeds and are authenticated with a per-workspace token.

Event Types

All streaming integrations (Splunk, Elasticsearch, Sentinel, Syslog, Wazuh) receive events for:

Event type	When it fires
attack_open	Incident opens (threshold crossed + classified)
attack_update	Significant change: PPS increase >50%, new source IPs, mitigation applied
attack_resolved	Incident closed (traffic returned to baseline)
mitigation_applied	BGP rule announced, firewall rule executed, or scrubbing activated
exposure_finding	New finding from an Exposure scan (CVE, open port, TLS issue)