{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Hunters SIEM Integration","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"hunters-siem-integration","__idx":0},"children":["Hunters SIEM Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Stream Capsule detections, findings, and policy violations into ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://www.hunters.ai/"},"children":["Hunters"]}," so your SOC can triage AI-agent and shadow-AI signals alongside the rest of your security telemetry."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule continuously exports security events to a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["dedicated Amazon S3 bucket that Capsule provisions and manages"]}," for each integration. Hunters ingests directly from that bucket by assuming a read-only IAM role, scoped with the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External ID"]}," Hunters gives you."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Event type"},"children":["Event type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What gets exported"},"children":["What gets exported"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Real-time detections raised on agent activity, with full event context"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Posture and configuration findings across your AI inventory"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Guardrail and policy breaches, including the offending request or response"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Events are written verbosely as newline-delimited JSON (NDJSON) as they are produced, so Hunters receives the same detail Capsule holds internally."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Capsule event (detection / finding / policy violation)\n  → written to Capsule-managed S3 bucket (one per integration)\n  → Hunters assumes the read-only role (External ID enforced)\n  → Hunters ingests the objects\n"},"children":[]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is separate from ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Notifications"]},". Notifications push individual alerts to a channel; the SIEM integration streams the full, verbose event record to S3 for ingestion and long-term correlation."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"how-this-differs-from-hunters-standard-setup","__idx":2},"children":["How this differs from Hunters' standard setup"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Hunters' ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://docs.hunters.ai/docs/step-3-set-up-bucket-access-1#IAMrole"},"children":["Set up bucket access"]}," guide, under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["\"Create a new IAM role for Hunters manually\""]},", normally asks you to create the S3 bucket and the IAM role yourself in your own AWS account."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["With Capsule you don't do any of that."]}," Capsule owns the bucket and creates the read role for you. Your only job is to copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Principal ARN"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External ID"]}," that Hunters shows you into Capsule — Capsule provisions everything else and hands you back the connection details to finish the Hunters side."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":3},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, ensure you have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule"]}," account with admin access, and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SIEM"]}," tab visible under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Hunters"]}," account with permission to add an AWS S3 data source (",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data > Connect Data Source"]},")"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-get-the-principal-arn-and-external-id-from-hunters","__idx":4},"children":["Step 1: Get the Principal ARN and External ID from Hunters"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In Hunters, begin the bucket-access setup and choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create a new IAM role for Hunters manually"]}," (see the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://docs.hunters.ai/docs/step-3-set-up-bucket-access-1#IAMrole"},"children":["Hunters guide"]},")."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Locate the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Principal ARN"]}," — Hunters' AWS identity, e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam::685648138888:root"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Locate the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External ID"]}," — a unique value Hunters generates for this connection."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keep both values handy. Leave the Hunters tab open; you'll return to it in Step 3."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Stop after copying these two values."]}," Do ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["not"]}," follow Hunters' AWS instructions to create the bucket, the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["HuntersBucketAccess"]}," policy, or the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["hunters-assume-role"]}," role. Capsule performs all of that for you in the next step."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-create-the-siem-integration-in-capsule","__idx":5},"children":["Step 2: Create the SIEM integration in Capsule"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In Capsule, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → SIEM"]}," and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add integration"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Destination"]}," is fixed to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Amazon S3"]}," — this is the bucket Hunters will read from."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enable the event types you want Hunters to receive: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]},", and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Paste the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Principal ARN"]}," from Step 1 into the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Principal ARN"]}," field."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Paste the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External ID"]}," from Step 1 into the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External ID"]}," field. An External ID is required whenever a Principal ARN is set — this is what protects the role against confused-deputy access."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On save, Capsule provisions a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["dedicated S3 bucket"]}," for this integration and a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["read-only IAM role"]}," whose trust policy allows the Hunters Principal ARN to assume it, but only when the request carries your External ID."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can create more than one SIEM integration — each gets its own isolated bucket and role, so different Hunters environments or event scopes never share a destination."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-copy-the-connection-details-back-to-hunters","__idx":6},"children":["Step 3: Copy the connection details back to Hunters"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the SIEM list, open the integration's row menu and choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["View details"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connection details"]},", copy the values Capsule generated:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Bucket name"]}," — the S3 bucket Hunters ingests from"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Region"]}," — the AWS region the bucket lives in"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Read role ARN"]}," — the role Hunters assumes to read the bucket"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Return to the Hunters tab and provide these values where Hunters asks for the bucket and the role it should assume, then run Hunters' connection validation to finish."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connection details will appear once the bucket is provisioned."]}," If the section shows a pending hint, give provisioning a moment and reopen the drawer."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"data-format-and-retention","__idx":7},"children":["Data format and retention"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Layout"]}," — objects are keyed by event type and date: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["<event-type>/YYYY/MM/DD/<timestamp>-<id>.ndjson"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Format"]}," — each object is NDJSON: one JSON event per line, with the full verbose record."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Retention"]}," — objects expire automatically ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["30 days"]}," after they are written. Configure Hunters to ingest continuously so nothing is missed before expiry."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"ingestion-prefixes","__idx":8},"children":["Ingestion prefixes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every object lives under one of three top-level prefixes — these are the only keys at the bucket root:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"detections/\nfindings/\npolicy-violations/\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Hunters asks for a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Prefix"]}," here (it rejects the setup with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["must have required property 'Prefix(es)'"]}," until you provide one). The field is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["not"]}," a free-form regex — it's a comma-separated list of path templates. Each entry may contain literal segments (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["[\\w\\-.]"]},"), ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/"]}," separators, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["*"]}," wildcards, and the date placeholders ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{YYYY}"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{MM}"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{DD}"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{HH}"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["{mm}"]},". Use no leading slash, no spaces, and no trailing comma."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Because Capsule partitions objects by date, point the placeholders at that layout so Hunters lists new partitions efficiently:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"detections/{YYYY}/{MM}/{DD}/,findings/{YYYY}/{MM}/{DD}/,policy-violations/{YYYY}/{MM}/{DD}/\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you don't need date partitioning, the plain literal prefixes also validate:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"detections/,findings/,policy-violations/\n"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Drop any event types you didn't enable from the list."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"how-access-is-scoped","__idx":9},"children":["How access is scoped"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The bucket and role live in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule's managed AWS account"]},", not yours — there is nothing to maintain on your side."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The read role grants only ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s3:ListBucket"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s3:GetBucketLocation"]},", and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s3:GetObject"]},", and only on that one integration's bucket."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The trust policy requires ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["both"]}," the Hunters Principal ARN ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["and"]}," the matching External ID, so no other party can assume the role even if the ARN is known."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":10},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"connection-details-never-appear","__idx":11},"children":["Connection details never appear"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the integration is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["enabled"]}," and has at least one event type turned on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Reopen the details drawer after a short wait — the bucket and role are provisioned on save."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"hunters-cant-read-the-bucket","__idx":12},"children":["Hunters can't read the bucket"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["External ID"]}," in Capsule matches exactly what Hunters displays — a mismatch blocks the role assumption."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Principal ARN"]}," you pasted is the one from Hunters (no trailing spaces or truncation)."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm Hunters is configured with the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Read role ARN"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Bucket name"]}," exactly as shown in the Capsule details drawer."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"no-events-arriving","__idx":13},"children":["No events arriving"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the relevant event types (",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]},") are enabled on the integration."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["New events flow only after the integration is created — historical events are not backfilled."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Remember objects expire after 30 days; a paused ingestion can miss older data."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":14},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration, contact ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"mailto:support@capsule.security"},"children":["support@capsule.security"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For Hunters-side configuration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://docs.hunters.ai/docs/step-3-set-up-bucket-access-1#IAMrole"},"children":["Hunters: Set up bucket access"]}]}]}]},"headings":[{"value":"Hunters SIEM Integration","id":"hunters-siem-integration","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"How this differs from Hunters' standard setup","id":"how-this-differs-from-hunters-standard-setup","depth":3},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Get the Principal ARN and External ID from Hunters","id":"step-1-get-the-principal-arn-and-external-id-from-hunters","depth":2},{"value":"Step 2: Create the SIEM integration in Capsule","id":"step-2-create-the-siem-integration-in-capsule","depth":2},{"value":"Step 3: Copy the connection details back to Hunters","id":"step-3-copy-the-connection-details-back-to-hunters","depth":2},{"value":"Data format and retention","id":"data-format-and-retention","depth":2},{"value":"Ingestion prefixes","id":"ingestion-prefixes","depth":3},{"value":"How access is scoped","id":"how-access-is-scoped","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Connection details never appear","id":"connection-details-never-appear","depth":3},{"value":"Hunters can't read the bucket","id":"hunters-cant-read-the-bucket","depth":3},{"value":"No events arriving","id":"no-events-arriving","depth":3},{"value":"Support","id":"support","depth":2}],"frontmatter":{"seo":{"title":"Hunters SIEM Integration"}},"lastModified":"2026-07-06T11:34:34.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/hunters-siem","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}