SIEM

The SIEM page, under Administration > Configuration > SIEM, forwards WitnessAI prompts, alerts and audit logs to your Security Information and Event Management (SIEM) platform. You need the Admin role or higher to change it.

Connection Settings

Choose your SIEM Platform from the drop-down: Amazon S3, Cribl, Crowdstrike, Exabeam, Google Secops, Splunk, Sumo Logic, Other (HEC) or Other (Bearer Token). The fields below it change to match the platform you choose. If your platform isn't listed, use Other (HEC) for an HTTP Event Collector endpoint or Other (Bearer Token) for an endpoint that takes a bearer token.

Fill in all the data fields for your SIEM Platform.

The most common required fields include:

URL: Enter the endpoint into the URL field. Not shown for Amazon S3.
Authentication Token: Not shown for Google SecOps or Amazon S3. You can paste the raw token. If it doesn't already start with the scheme your platform expects, such as Splunk or Bearer, WitnessAI adds it.
Sync Frequency: Enter the number of records to send per synchronization, from 1 to 999. WitnessAI also sends a partial batch after about 60 seconds without new records, so events still arrive during quiet periods.
Splunk requires a Splunk Index. The index must be created before configuring Splunk as your SIEM.
Google SecOps: The URL must include the following query parameters:

Key: Your Google SecOps API key
Secret: Your SecOps API secret
Example: https://your-instance.googleapis.com/v1/endpoint?key=my-secops-key&secret=my-secops-secret

SIEM Data Integration

Choose one radio button to forward Prompts & Alerts or Alerts Only to your SIEM. Alerts Only is the default. It forwards only prompts with the highest risk score, 3, so prompts that score 0 to 2 aren't sent.

Additional data options:

Check any boxes next to your desired data and formats listed.

Include Audit Logs to send Audit Logs to your SIEM. Documentation here.

JSON Lines Format: Documentation here.

Include Sanitized Prompt: This will send the redacted version of prompts to your SIEM. Documentation here.

Include Raw Prompt and Response: This will send the original version of prompts and responses, that include sensitive data to your SIEM. Documentation here.

Include LLM Response: Sends the model's response to your SIEM.

Warning: Include Raw Prompt and Response sends unredacted prompts and responses, including any sensitive data in them, to your SIEM. Turn it on only if your SIEM meets your data-handling requirements.

Click Save.

How delivery works

A batch goes out when it reaches your Sync Frequency, or after about 60 seconds of inactivity, whichever comes first.
For HTTP-based platforms, only an HTTP 200 response counts as delivered.
A batch that fails isn't retried automatically, so those events may never reach your SIEM. Watch for gaps on the SIEM side. If events stop arriving, check that the endpoint is reachable and returns HTTP 200, save the configuration again, and contact WitnessAI support if the gap continues.

To confirm delivery, check your SIEM platform for incoming WitnessAI records after you save.

Exabeam Additional Details

The Exabeam Webhook Cloud Collector documentation is here.

Enter your preferred URL based on your Region. The Exabeam list of Regions for Cloud Collectors is here.

Splunk Additional Details

The Splunk steps are near-identical to the steps for Exabeam. The Splunk HTTP Event Collector (HEC) documentation is here.

Amazon S3 Details

When Amazon S3 is selected as the SIEM Platform, the Amazon S3 Configuration section displays the following fields:

S3 Bucket Name: Enter the name of the destination S3 bucket.
IAM Role ARN: Enter the IAM role that WitnessAI will assume to write logs to your S3 bucket. The ARN must start with arn:aws:iam::.
AWS Region: Enter the AWS region where your S3 bucket is located.
External ID: Used in the IAM role trust policy to verify WitnessAI’s identity. Click the copy icon to copy the value.

Your organization will need to create a AWS External ID, and a role that allows writing to the S3 bucket. Creating an External ID requires an AWS ID from the external entity that needs to write to your S3 bucket.
Contact WitnessAI Customer Success to request the correct AWS ID for your dedicated WintessAI deployment.
Learn more at How to Use External ID When Granting Access to Your AWS Resources | Amazon Web Services

Prefix: Enter the S3 key prefix (folder path) for organizing log files within the bucket. This field is required.
Session Name: Optional name for the STS session used when assuming the IAM role.
Sync Frequency: Enter the number of items to send per sync.

Click Save.

SIEM Events Schema

This document describes the event fields a customer can receive when WitnessAI forwards alert, prompt, and audit data to a configured SIEM destination.

Not every field appears on every event. Field presence depends on the event type, the configured SIEM forwarding options, the AI application, and whether the prompt included files or triggered guardrail results.

1. Delivery Formats

WitnessAI can deliver SIEM events in the following formats:

JSON array: multiple event envelopes in one JSON array.
NDJSON: one event envelope per line.
AWS S3 object: one event envelope per JSON object.

In all formats, the payload uses the same event envelope and inner event fields.

2. Event Envelope

Each SIEM event is wrapped in an envelope. The envelope is the outer object received by the SIEM.

Field	Type	Required	Description	Example
time	integer	No	Unix timestamp in seconds for when the event was emitted.	1716400000
host	string	No	Host value associated with the WitnessAI forwarding environment.	witness-host
source	string	No	Event source name.	witness-source
sourcetype	string	No	Event source type.	json
index	string	No	Customer-configured SIEM index. Some environments may send “null” if no index is configured.	main
event	object	Yes	Event payload container. Contains prompt or audit.	{ “prompt”: “{…}” }
fields	object	No	Additional event metadata.	{ “request_id”: “…” }

event.prompt and event.audit are JSON-encoded strings. SIEM parsers should parse the string value as JSON to access the inner fields documented below.

3. Event Types

Event Type	Envelope Field	Description
Prompt or alert event	event.prompt	Prompt activity, including alert details when present.
Audit event	event.audit	Administrative or user action audit data.

4. Prompt And Alert Payload

Prompt and alert events are delivered under event.prompt. Alerts use the same prompt payload and include populated risk information in score_cards and, when present, alerts.

The subsections below describe nested parts of the same parsed event.prompt object. They are not separate SIEM events and do not need to be combined manually.

4.1. Prompt Fields

Field	Type	Description	Example Values
id	string	Prompt ID.	UUID
conversation_id	string	Conversation ID associated with the prompt.	UUID
input	string	Original user prompt, when enabled for SIEM forwarding.	Summarize this policy document
sanitized	string	Sanitized prompt text, when enabled for SIEM forwarding.	Summarize this policy document
llm_output	string	Model response/output, when enabled for SIEM forwarding.	Here is a summary…
desanitized	string	Desanitized response/output, when enabled for SIEM forwarding.	Here is a summary…
action	string	Action applied to the prompt.	allowed, blocked, warned
source	string	Source of the prompt.	client, api
application_name	string	Application associated with the prompt.	witness-client, ChatGPT, Claude, Copilot
application_version	string	Application version, when available.	1.0.0
proxy_name	string	Proxy name, when available.	witness-proxy
proxy_version	string	Proxy version, when available.	1.0.0
provider_name	string	AI provider name.	openai, anthropic, google
model_name	string	AI model name.	gpt-4, claude-sonnet, gemini-pro
filter_output	object	Additional classification output. Shape varies by guardrail or classifier.	{ “topic”: “Security” }
warning_count	integer	Number of warning results.	0, 1
error_count	integer	Number of error results.	0, 1
incomplete_count	integer	Number of incomplete results.	0, 1
result	string	Overall processing result.	pass, fail, warning, incomplete, blocked, skipped
risk_score	integer	Overall risk score. Higher values indicate more risk.	0, 1, 2, 3

input_score	integer	Risk score for user input, when present.	0, 1, 2, 3
output_score	integer	Risk score for model output, when present.	0, 1, 2, 3
combined_score	integer	Combined input and output risk score, when present.	0, 1, 2, 3
prompt_index	integer	Prompt sequence number within the conversation.	1, 2, 3
user_initiated_time	string	Time the user initiated the prompt, when available.	RFC3339 timestamp
policy_id	string	Policy ID evaluated for the prompt.	UUID
policy_name	string	Policy name evaluated for the prompt.	Global AI Policy
policy_version	integer	Policy version evaluated for the prompt.	1
created	string	Prompt record creation time, when present.	RFC3339 timestamp
updated	string	Prompt record update time, when present.	RFC3339 timestamp
tags	array	Tags associated with the prompt, when present.	[ ]
attachments	array	Attachment metadata, when present.	See Attachment Fields
prompt_metrics	array	Prompt metrics, when present.	See Prompt Metric Fields
conversation	object	Conversation context, when present.	See Conversation Fields
score_cards	array	Guardrail or classifier results, when present.	See Score Card Fields
alerts	array	Alert records, when present.	See Alert Fields

4.2. Conversation Fields

Field	Type	Description	Example Values
id	string	Conversation ID.	UUID
user_id	string	User ID associated with the conversation, when available.	UUID
title	string	Conversation title, when available.	Policy review
prompt_count	integer	Number of prompts in the conversation, when available.	1, 2
last_prompt_risk_score	integer	Risk score of the most recent prompt, when available.	0, 1, 2, 3
created	string	Conversation creation time, when present.	RFC3339 timestamp
updated	string	Conversation update time, when present.	RFC3339 timestamp

4.3. Conversation User Fields

When present, conversation.user contains user context associated with the conversation.

Field	Type	Description	Example Values
id	string	User ID.	UUID
email	string	User email.	user@example.com
user_name	string	Username.	user.name

4.4. Attachment Fields

When present, attachments[] contains metadata for files processed as part of a prompt event.

Field	Type	Description	Example Values
file_id	string	Attachment file ID.	UUID
file_location	string	Attachment storage path or location reference.	/attachments/gemini/…/file.pdf
file_name	string	Original file name.	example.pdf
file_size	integer	File size in bytes.	19698

4.5. Prompt Metric Fields

When present, prompt_metrics[] contains timing or size metrics associated with prompt processing.

Field	Type	Description	Example Values
metric_name	string	Raw metric name.	g3-request-time, request_payload_size
metric_value	number	Metric value. Units vary by metric.	2559.276354, 19698
prompt_id	string	Prompt ID associated with the metric.	UUID

4.6. Score Card Fields

Field	Type	Description	Example Values
id	string	Score card ID, when present.	UUID
prompt_id	string	Prompt ID associated with the score card.	UUID
report_type	string	Portion of the interaction evaluated.	input, output
started_at	string	Evaluation start time, when present.	RFC3339 timestamp
completed_at	string	Evaluation completion time, when present.	RFC3339 timestamp
data_modified	boolean	Whether the data was modified by the evaluation.	true, false
confidence	integer	Confidence score for the evaluation result, when present.	0 to 100
risk_score	integer	Risk score for this score card.	0, 1, 2, 3
risk_type	string	Risk category.	Data Leakage, Prompt Injection, Privacy Violation, None
risk_metric	string	Risk level.	None, Low, Medium, High
message	string	Human-readable evaluation message.	sensitive data detected
result	string	Evaluation result.	pass, fail, warning, incomplete, blocked, skipped
filter_identifier	string	Raw identifier for the guardrail or classifier that produced the result.	llm-manager, fl-pre-topic-categorizer, fl-pre-prompt-safety, svc-pre-fileprocessor
rule_result	string	Rule result, when present.	pass, fail
rule_message	string	Rule message, when present.	matched restricted pattern

4.7. Alert Fields

Field	Type	Description	Example Values
id	string	Alert ID.	string
metadata	object	Alert metadata. Shape varies by alert type.	{ “risk_metric”: “High” }
created	string	Alert creation time, when present.	RFC3339 timestamp
updated	string	Alert update time, when present.	RFC3339 timestamp

5. Audit Payload

Audit events are delivered under event.audit.

Field	Type	Description	Example Values
id	string	Audit event ID.	UUID
initiated_by_type	string	Actor type.	user, access_token
initiated_by_id	string	Actor ID, when available.	UUID
auth	object	Authenticated actor details, when available.	See Audit Auth Fields
record_name	string	Entity or record type.	policy, user, groups, app-catalog, stringlists
record_alias	string	Human-readable record name, when present.	Global AI Policy
record_id	string	Entity or record ID.	string
action	string	Action performed.	create, update, delete, login, clickthrough_accept, clickthrough_decline
status	string	Action status.	success, failure, error
created_at	string	Audit event creation time.	RFC3339 timestamp
updated_at	string	Audit event update time.	RFC3339 timestamp
metadata	object	Audit metadata.	See Audit Metadata Fields

5.1. Audit Auth Fields

Field	Type	Description	Example Values
identifier	string	Unique actor identifier.	string
email	string	Actor email, when present.	user@example.com
first_name	string	Actor first name, when present.	Jane
last_name	string	Actor last name, when present.	Doe
username	string	Actor username, when present.	jane.doe
token_id	string	Token ID, when present.	string
token_type	string	Token type.	user, access_token
roles	array	Actor roles, when present.	[ ]

5.2. Audit Metadata Fields

Field	Type	Description	Example Values
title	string	Audit event title.	Policy updated
changes	array	Structured list of changes.	[ ]
old	object	Previous record value, when present.	{}
new	object	New record value, when present.	{}
record	object	Record snapshot, when present.	{}

metadata.changes[] entries may include:

Field	Type	Description	Example Values
old	object	Previous field value.	{ “value”: null }
new	object	New field value.	{ “value”: “Updated value” }
path	string	Changed field path.	policy.name
label	string	Human-readable field label.	Policy Name added

6. Forwarding Configuration Effects

The customer-controlled SIEM configuration determines which payload fields are present.

Setting	Effect On SIEM Payload
Prompt events enabled	Prompt payloads are forwarded.
Alert events enabled	Prompt payloads with alert/risk information are forwarded.
Audit events enabled	Audit payloads are forwarded.
Include sanitized prompt field	Controls whether sanitized can appear.
Include original/desanitized prompt fields	Controls whether input and desanitized can appear.
Include LLM output field	Controls whether llm_output can appear.
JSON lines enabled	Sends one event envelope per line instead of a JSON array.

7. Example Prompt Event

The SIEM envelope contains event.prompt as a JSON-encoded string.


{
    "time": 1716400000,
    "host": "witness-host",
    "source": "witness-source",
    "sourcetype": "json",
    "index": "main",
    "event": {
        "prompt": "<stringified prompt JSON>"
    },
    "fields": {
        "request_id": "00000000-0000-0000-0000-000000000001"
    }
}

After parsing event.prompt, a prompt payload can look like this. Alert-enabled prompt events use the same shape; alert-specific details appear in score_cards and, when present, alerts.


{
    "id": "00000000-0000-0000-0000-000000000001",
    "conversation_id": "00000000-0000-0000-0000-000000000002",
    "action": "allowed",
    "input": "Number of colors in the rainbow?",
    "sanitized": "Number of colors in the rainbow?",
    "llm_output": "There are seven colors in the rainbow: red, orange, yellow, green, blue, indigo, and violet.",
    "desanitized": "There are seven colors in the rainbow: red, orange, yellow, green, blue, indigo, and violet.",
    "source": "client",
    "application_name": "witness-client",
    "filter_output": {
        "topic": "Education & Learning",
        "subtopic": "Science Facts",
        "intent": "Learn about rainbow colors"
    },
    "result": "pass",
    "risk_score": 0,
    "input_score": 0,
    "output_score": 0,
    "combined_score": 0,
    "prompt_index": 1,
    "policy_id": "00000000-0000-0000-0000-000000000003",
    "policy_name": "Global AI Policy",
    "policy_version": 1,
    "conversation": {
        "id": "00000000-0000-0000-0000-000000000002",
        "user_id": "00000000-0000-0000-0000-000000000004",
        "user": {
            "id": "00000000-0000-0000-0000-000000000004",
            "email": "user@example.com",
            "user_name": "user"
        }
    },
    "score_cards": [
        {
            "prompt_id": "00000000-0000-0000-0000-000000000001",
            "report_type": "input",
            "data_modified": false,
            "risk_type": "None",
            "risk_metric": "None",
            "result": "pass",
            "filter_identifier": "llm-manager"
        },
        {
            "prompt_id": "00000000-0000-0000-0000-000000000001",
            "report_type": "input",
            "data_modified": false,
            "risk_type": "None",
            "risk_metric": "None",
            "message": "Learn about rainbow colors",
            "result": "pass",
            "filter_identifier": "fl-pre-topic-categorizer"
        }
    ],
    "attachments": [],
    "prompt_metrics": [],
    "tags": []
}

8. Example Attachment Prompt Event

Attachment events use the same event.prompt envelope. Attachment-specific information appears in attachments, prompt_metrics, filter_output, and score_cards.


{
    "time": 1716400000,
    "host": "witness-host",
    "source": "witness-source",
    "sourcetype": "json",
    "index": "main",
    "event": {
        "prompt": "<stringified attachment prompt JSON>"
    },
    "fields": {
        "request_id": "00000000-0000-0000-0000-000000000010"
    }
}

After parsing event.prompt, an attachment prompt payload can look like this:


{
    "id": "00000000-0000-0000-0000-000000000010",
    "conversation_id": "00000000-0000-0000-0000-000000000011",
    "action": "allowed",
    "application_name": "gemini",
    "input": "The file \"example.pdf\" was processed.",
    "sanitized": "The file \"example.pdf\" was processed.",
    "llm_output": "File processing complete",
    "desanitized": "File processing complete",
    "filter_output": {
        "risk_type": "Data Leakage",
        "risk_metric": "Medium"
    },
    "risk_score": 3,
    "input_score": 0,
    "output_score": 0,
    "combined_score": 0,
    "prompt_index": 3,
    "policy_id": "00000000-0000-0000-0000-000000000012",
    "policy_name": "Observability Policy",
    "policy_version": 205,
    "conversation": {
        "id": "00000000-0000-0000-0000-000000000011",
        "user_id": "00000000-0000-0000-0000-000000000013",
        "user": {
            "id": "00000000-0000-0000-0000-000000000013",
            "email": "user@example.com",
            "user_name": "user@example.com"
        }
    },
    "attachments": [
        {
            "file_id": "00000000-0000-0000-0000-000000000014",
            "file_location": "/attachments/gemini/00000000-0000-0000-0000-000000000010/example.pdf",
            "file_name": "example.pdf",
            "file_size": 19698
        }
    ],
    "prompt_metrics": [
        {
            "metric_name": "g3-request-time",
            "metric_value": 2559.276354,
            "prompt_id": "00000000-0000-0000-0000-000000000010"
        },
        {
            "metric_name": "request_payload_size",
            "metric_value": 19698,
            "prompt_id": "00000000-0000-0000-0000-000000000010"
        }
    ],
    "score_cards": [
        {
            "filter_identifier": "svc-pre-file-processor",
            "message": "Attachments processed successfully",
            "report_type": "input",
            "result": "pass",
            "risk_metric": "None",
            "risk_type": "None"
        },
        {
            "filter_identifier": "fl-pre-anonymizer",
            "confidence": 100,
            "data_modified": true,
            "message": "attachments required anonymization",
            "report_type": "input",
            "result": "pass",
            "risk_metric": "Medium",
            "risk_score": 3,
            "risk_type": "Data Leakage",
            "rule_message": "Be careful with sharing sensitive data",
            "rule_result": "warn"
        }
    ],
    "tags": []
}

9. Example Audit Event

The SIEM envelope contains event.audit as a JSON-encoded string.


{
    "time": 1716400000,
    "host": "witness-host",
    "source": "witness-source",
    "sourcetype": "json",
    "index": "main",
    "event": {
        "audit": "<stringified audit JSON>"
    },
    "fields": {
        "request_id": "00000000-0000-0000-0000-000000000004"
    }
}

After parsing event.audit, an audit payload can look like this:


{
    "id": "00000000-0000-0000-0000-000000000004",
    "initiated_by_type": "access_token",
    "initiated_by_id": "00000000-0000-0000-0000-000000000005",
    "auth": {
        "identifier": "customer-token",
        "roles": [
            "super-admin"
        ],
        "token_id": "00000000-0000-0000-0000-000000000005",
        "token_type": "access_token"
    },
    "record_name": "policy",
    "record_alias": "policy",
    "record_id": "00000000-0000-0000-0000-000000000006",
    "action": "create",
    "status": "success",
    "created_at": "2026-05-18T22:00:00Z",
    "updated_at": "2026-05-18T22:00:00Z",
    "metadata": {
        "title": "Global AI Policy",
        "changes": [
            {
                "path": "policy.name",
                "label": "Policy Name added",
                "old": {
                    "value": null
                },
                "new": {
                    "value": "Global AI Policy"
                }
            }
        ]
    }
}

SIEM Integrations Connection Settings SIEM Data Integration How delivery works Exabeam Additional Details Splunk Additional Details Amazon S3 Details