{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Databahn SIEM Integration","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"databahn-siem-integration","__idx":0},"children":["Databahn SIEM Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Push Capsule detections, findings, and policy violations into a ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://www.databahn.ai/"},"children":["Databahn"]}," pipeline through an HTTP source, so Databahn can normalize them and route them to whichever SIEM or data lake your SOC runs."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule sends each event to your Databahn HTTP source as it is produced, authenticated with the source's bearer token. Databahn then applies your pipeline's parsing, enrichment, and routing like any other source."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Event type"},"children":["Event type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What gets exported"},"children":["What gets exported"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Real-time detections raised on agent activity, with full event context"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Posture and configuration findings across your AI inventory"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Guardrail and policy breaches, with the full evidence the decision was made on"]}]}]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Capsule event (detection / finding / policy violation)\n  → POST to your Databahn HTTP source, as a JSON array, with a bearer token\n  → one Databahn record per array element\n  → your pipeline parses, enriches, and routes it\n  → your SIEM or data lake\n"},"children":[]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is separate from ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Notifications"]},". Notifications push individual alerts to a channel; the SIEM integration streams the full, verbose event record for ingestion and long-term correlation."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule"]}," account with admin access, and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SIEM"]}," tab visible under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Databahn"]}," account with permission to add a source to a pipeline"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An HTTP source reachable from the internet over ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]},". If the source runs on a Smart Edge collector inside your network, expose it through a load balancer or gateway with a certificate from a public CA: Capsule verifies the certificate and does not accept self-signed ones."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-prepare-databahn","__idx":3},"children":["Step 1: Prepare Databahn"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In Databahn, add a new ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["HTTP"]}," source to the pipeline that should receive Capsule's events."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set its authentication to a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["bearer token"]}," and generate the token."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Copy the source's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["URL"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["token"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each request from Capsule is a top-level JSON array whose elements are individual events. Configure the source so that each array element becomes its own record."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The token grants write access to your pipeline."]}," Anyone holding it, together with the URL, can send records into Databahn. Treat it like a password."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-create-the-siem-integration-in-capsule","__idx":4},"children":["Step 2: Create the SIEM integration in Capsule"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In Capsule, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → SIEM"]}," and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add integration"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Destination"]}," to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Databahn"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enable the event types you want: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Choose an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Event detail"]}," level:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Full"]}," sends the whole envelope, matching the S3, Splunk, OpenTelemetry, and Rapid7 exports."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Compact"]}," omits activity message bodies. Use it to cut ingested volume, or where the transcript is not what you search on."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Paste the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Source URL"]}," from Step 1, exactly as Databahn shows it. Capsule only accepts an ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]}," URL and posts to it as given, without adding a path."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Paste the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token"]},". It is stored as a secret and never shown again."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},", then ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["enable"]}," the integration. A new integration starts disabled and exports nothing until you turn it on."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When you edit the integration later, leave ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Token"]}," empty to keep the saved one. To rotate it, generate a new token on the HTTP source, paste it into the integration, and save."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-verify","__idx":5},"children":["Step 3: Verify"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the row menu's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Send test event"]},". Capsule posts a single connection-test event to the source and reports whether Databahn accepted it, with Databahn's error if it did not. The event is a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["detection.created"]}," whose ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event.detection.detectionType"]}," is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["CAPSULE_CONNECTION_TEST"]},", so it is easy to filter out in your pipeline or downstream."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delivery"]}," column on the SIEM list shows the outcome of the most recent attempt, and the details drawer shows the last error in full."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"event-envelope","__idx":6},"children":["Event envelope"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each event carries the same envelope, with the record under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{ \"schemaVersion\": 2, \"eventType\": \"policy_violation.created\", \"tenantId\": \"...\", \"exportedAt\": \"...\", \"event\": { ... } }\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["eventType"]}," is one of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["detection.created"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["finding.created"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy_violation.created"]},". This is the same envelope the other SIEM destinations send, so a tenant exporting to more than one sees identical content. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["exportedAt"]}," is when Capsule sent the event, and the record's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["createdAt"]}," (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event.detection.createdAt"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event.finding.createdAt"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event.issue.createdAt"]},") is when it was raised. Use ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["createdAt"]}," as the event time in your pipeline."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every event carries its anchor resource in full - id, name, type, external id, parent, and the environment and connector it was discovered through - so events correlate against the rest of your inventory without a lookup."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy_violation.created"]}]}," is self-contained: the violation under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event.issue"]},", the policy that raised it under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event.policy"]}," including its conditions, and the complete finding, detection and activity records the decision was made on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["detection.created"]}]}," carries the detection, its evidence, and the session activities it was raised on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["finding.created"]}]}," carries the finding, its evidence, and its remediation steps."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Triage state is exported on all three. Secrets Capsule identified in evidence are masked to a short prefix before export, in evidence text and activity message bodies alike."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Policy violations carry Capsule's severity at ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event.issue.severity"]},", in lower case: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["low"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["medium"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["high"]},", or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["critical"]},". Capsule does not rank detections or findings, so those events have no severity field."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["One violation, one event."]}," A violation is exported once, when it is first raised. If it is later resolved and the same condition re-triggers, Capsule reuses the existing violation and does not emit a second ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy_violation.created"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"delivery-behaviour","__idx":7},"children":["Delivery behaviour"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Latency"]}," - events are sent as they are produced, inline with the detection, finding, or violation being created."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Format"]}," - each request is a JSON array of events with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Content-Type: application/json"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization: Bearer <token>"]},", uncompressed, kept under 5 MB."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Retries"]}," - Capsule retries ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["429"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["5xx"]},", timeouts, and network errors up to twice within 20 seconds, honouring ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Retry-After"]},". Every other failure is a configuration error and is reported instead."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Timeouts"]}," - each request has 10 seconds to complete."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Redirects"]}," - never followed, so events and the token only ever go to the host you configured."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Visibility"]}," - the outcome of the most recent attempt is shown per integration in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → SIEM"]},", with the full error in the details drawer. The token is masked in error text."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Backfill"]}," - export begins when the integration is enabled. Events raised before that are not sent."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":8},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"the-databahn-source-url-redirected-http-3xx","__idx":9},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["The Databahn source URL redirected"]}," (HTTP 3xx)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The saved URL is not the one the source listens on, for example it points at a gateway that forwards to it. Copy the URL from the source again and paste it exactly."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"databahn-rejected-the-token-http-401-or-403","__idx":10},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Databahn rejected the token"]}," (HTTP 401 or 403)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Databahn did not accept the token. Generate a new token on the HTTP source, paste it into the integration, and save."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"databahn-has-no-http-source-at-this-url-http-404","__idx":11},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Databahn has no HTTP source at this URL"]}," (HTTP 404)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The source was deleted, or the URL is wrong. Check the source URL saved on the integration against the one Databahn shows."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"databahn-rejected-the-request-as-too-large-http-413","__idx":12},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Databahn rejected the request as too large"]}," (HTTP 413)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Switch ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Event detail"]}," to Compact to shrink the events."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"this-databahn-integration-has-no-token-stored","__idx":13},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["This Databahn integration has no token stored"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The integration has no saved token. Edit it, paste the token from the HTTP source, and save."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"nothing-arrives-at-all","__idx":14},"children":["Nothing arrives at all"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the integration is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["enabled"]}," and at least one event type is turned on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Send test event"]}," - it reports the exact error from Databahn."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the source is reachable from the internet over ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]},", with a certificate from a public CA."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Events raised before the integration was enabled are not sent. Wait for a new detection, finding, or violation, or send a test event."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":15},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration, contact ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"mailto:support@capsule.security"},"children":["support@capsule.security"]},"."]}]},"headings":[{"value":"Databahn SIEM Integration","id":"databahn-siem-integration","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Prepare Databahn","id":"step-1-prepare-databahn","depth":2},{"value":"Step 2: Create the SIEM integration in Capsule","id":"step-2-create-the-siem-integration-in-capsule","depth":2},{"value":"Step 3: Verify","id":"step-3-verify","depth":2},{"value":"Event envelope","id":"event-envelope","depth":2},{"value":"Delivery behaviour","id":"delivery-behaviour","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"The Databahn source URL redirected (HTTP 3xx)","id":"the-databahn-source-url-redirected-http-3xx","depth":3},{"value":"Databahn rejected the token (HTTP 401 or 403)","id":"databahn-rejected-the-token-http-401-or-403","depth":3},{"value":"Databahn has no HTTP source at this URL (HTTP 404)","id":"databahn-has-no-http-source-at-this-url-http-404","depth":3},{"value":"Databahn rejected the request as too large (HTTP 413)","id":"databahn-rejected-the-request-as-too-large-http-413","depth":3},{"value":"This Databahn integration has no token stored","id":"this-databahn-integration-has-no-token-stored","depth":3},{"value":"Nothing arrives at all","id":"nothing-arrives-at-all","depth":3},{"value":"Support","id":"support","depth":2}],"frontmatter":{"seo":{"title":"Databahn SIEM Integration"}},"lastModified":"2026-10-29T09:09:36.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/databahn-siem","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}