Account

Register a SIEM or SOAR push destination

Free and unmetered. Configure one destination and real-time findings from breach, domain, infostealer, SIM swap, OAuth and dark-web-channel monitoring dispatch to it automatically, with no polling. Send a body with neither format nor url to disable delivery.

Billing. Free. This endpoint is not metered.

Note. The destination is keyed on the account email behind your API key, so one destination is held per account, not per key.

post/v1/siem/configure

Request

  • Base URL: https://api.relayshield.net
  • URL: https://api.relayshield.net/v1/siem/configure
  • Auth: one of:
    • API key in header X-RS-API-KEY
    • HTTP bearer

Request body

format'splunk_hec' | 'cef' | 'xsoar_webhook'

Wire format. splunk_hec for Splunk HTTP Event Collector, cef for QRadar and other CEF consumers, xsoar_webhook for Cortex XSOAR's Generic Webhook incident shape.

urlstring uri

Destination URL. Must be http:// or https://.

auth_tokenstring

Token sent to the destination, e.g. a Splunk HEC token. Optional.

enabledboolean

Whether delivery is active. Defaults to true.

Response

Success. ok is true and data holds the result.

oktrue required

Changes

No recorded changes to this operation across all 1 revision of this API.