Connecting Your SIEM¶

Parapet Security receives alerts via webhook from your SIEM. This guide covers the general setup process - see the Integrations section for platform-specific instructions.

Overview¶

All SIEM integrations follow the same pattern:

1. Get your webhook URL from Parapet Security
2. Configure your SIEM to send alerts to that URL
3. Test the connection to verify alerts are arriving

Your Webhook URL¶

Your unique webhook URL is available in the dashboard:

1. Log in to app.parapetsecurity.com
2. Navigate to Settings → Service Tokens
3. Copy your webhook URL

The URL format is:

https://webhook-{region}.parapetsecurity.com/webhook/{tenant-id}

Where:

• {region} is us or eu based on your data region
• {tenant-id} is your unique tenant identifier (UUID)

Authentication¶

Parapet Security uses Bearer token authentication for webhooks.

Getting Your Service Token¶

1. Go to Settings → Service Tokens
2. Click Generate New Token
3. Give the token a descriptive name (e.g., "Wazuh Production")
4. Copy the token immediately - it won't be shown again

Using the Token¶

Include the token in the Authorization header:

POST /webhook/{tenant-id} HTTP/1.1
Host: webhook-us.parapetsecurity.com
Authorization: Bearer pst_abc123...
Content-Type: application/json

{
  "alert": {...}
}

What We Accept¶

Parapet Security's AI normalization can process alerts from any SIEM in any format:

Supported Formats¶

• JSON (preferred)
• XML
• CEF (Common Event Format)
• LEEF (Log Event Extended Format)
• Syslog

Content Types¶

• application/json
• application/xml
• text/plain

Payload Size¶

• Maximum payload size: 1 MB
• Alerts larger than 1 MB will be rejected

Testing Your Connection¶

Using cURL¶

Test your webhook with a sample alert:

curl -X POST https://webhook-us.parapetsecurity.com/webhook/{tenant-id} \
  -H "Authorization: Bearer {your-token}" \
  -H "Content-Type: application/json" \
  -d '{
    "source": "test",
    "timestamp": "2026-01-28T12:00:00Z",
    "severity": "high",
    "message": "Test alert from cURL"
  }'

Expected response:

{
  "status": "accepted",
  "alert_id": "550e8400-e29b-41d4-a716-446655440000"
}

Verifying in Dashboard¶

After sending a test alert:

1. Go to your Parapet Dashboard
2. Navigate to Alerts
3. You should see your test alert within 30 seconds

Firewall Configuration¶

If your SIEM is behind a firewall, ensure outbound HTTPS (port 443) is allowed to:

Rate Limits¶

Webhook endpoints are rate-limited based on your subscription tier:

Exceeding your rate limit returns HTTP 429 (Too Many Requests).

Error Handling¶

HTTP Response Codes¶

Retry Strategy¶

For transient errors (429, 500), implement exponential backoff:

Attempt 1: Wait 1 second
Attempt 2: Wait 2 seconds
Attempt 3: Wait 4 seconds
Attempt 4: Wait 8 seconds
...
Maximum: 5 retries or 60 seconds

Platform-Specific Guides¶

For detailed setup instructions for your specific SIEM:

• Wazuh
• Elastic SIEM
• CrowdStrike Falcon
• Microsoft Sentinel
• Splunk

Need Help?¶

If you're having trouble connecting your SIEM:

1. Check the Troubleshooting Guide
2. Verify your token is valid in Settings → Service Tokens
3. Contact support@parapetsecurity.com with:
   • Your SIEM platform and version
   • The HTTP response you're receiving
   • Your tenant ID (first 8 characters only)