CNSL can push incidents and detections to external SIEM and SOAR platforms in real time as they happen, without requiring any manual export step.

Three connectors are built in:

Every time a detection alert fires in detector.py, the result is pushed asynchronously to all enabled connectors. The push is fire-and-forget -- it does not delay detection or block the event loop.

If a push fails, the event is queued for retry (up to max_retries attempts with exponential backoff). The retry queue holds up to 1000 events in memory. Operators can also force a flush from the dashboard Settings tab.

The Splunk HTTP Event Collector (HEC) connector pushes events to:

POST {hec_url}/services/collector/event
Authorization: Splunk {token}
Content-Type: application/json

Payload format:

{
  "time":       1699999999.0,
  "host":       "my-server",
  "sourcetype": "cnsl:incident",
  "index":      "cnsl",
  "event": {
    "ip":             "45.33.32.1",
    "severity":       "HIGH",
    "reasons":        ["ssh_brute_force: 120 failures"],
    "_cnsl_version":  "2.9.0",
    "_push_time":     "2024-11-15T02:14:33Z"
  }
}

{
  "siem": {
    "splunk": {
      "enabled":      true,
      "hec_url":      "https://splunk.example.com:8088",
      "token":        "your-hec-token",
      "index":        "cnsl",
      "sourcetype":   "cnsl:incident",
      "host":         "my-cnsl-server",
      "verify_ssl":   true,
      "timeout_sec":  5,
      "max_retries":  3,
      "min_severity": "MEDIUM"
    }
  }
}

The Sentinel connector pushes to the Log Analytics Data Collector REST API using HMAC-SHA256 request signing:

POST https://{workspace_id}.ods.opinsights.azure.com/api/logs?api-version=2016-04-01
Authorization: SharedKey {workspace_id}:{signature}
Log-Type: CNSLIncident
Content-Type: application/json

Events appear in the Log Analytics workspace as a custom table named {log_type}_CL (e.g. CNSLIncident_CL).

{
  "siem": {
    "sentinel": {
      "enabled":      true,
      "workspace_id": "your-workspace-id",
      "shared_key":   "your-shared-key",
      "log_type":     "CNSLIncident",
      "api_version":  "2016-04-01",
      "timeout_sec":  5,
      "max_retries":  3,
      "min_severity": "MEDIUM"
    }
  }
}

1. Azure Portal > Log Analytics workspaces > your workspace
2. Settings > Agents
3. Copy "Workspace ID" and "Primary key"

The webhook connector sends a JSON POST to any HTTPS endpoint. This works with Palo Alto XSOAR, IBM QRadar (REST API ingest), PagerDuty Events v2, and any custom SOC ingest pipeline.

Payload format:

{
  "cnsl_version": "2.9.0",
  "push_time":    "2024-11-15T02:14:33Z",
  "event": {
    "ip":       "45.33.32.1",
    "severity": "HIGH",
    "reasons":  ["ssh_brute_force: 120 failures"]
  }
}

{
  "siem": {
    "webhook": {
      "enabled":      true,
      "url":          "https://your-soar.example.com/api/ingest",
      "method":       "POST",
      "headers":      {
        "X-API-Key": "your-api-key"
      },
      "bearer_token": "",
      "verify_ssl":   true,
      "timeout_sec":  5,
      "max_retries":  3,
      "min_severity": "MEDIUM"
    }
  }
}

GET /api/siem/status

Returns health, push counts, and error information for all connectors, plus the current retry queue depth.

{
  "any_enabled": true,
  "queue_depth": 0,
  "connectors": {
    "splunk": {
      "enabled":     true,
      "healthy":     true,
      "status":      200,
      "push_count":  42,
      "error_count": 0,
      "last_error":  null
    },
    "sentinel": { "enabled": false },
    "webhook":  { "enabled": false }
  }
}

POST /api/siem/test/{name}

Where {name} is splunk, sentinel, or webhook. Sends a synthetic LOW severity test event to verify the connector is working.

Returns {"ok": true, "connector": "splunk"} on success.

POST /api/siem/flush

Forces an immediate retry of all queued events. Returns counts by connector:

{"flushed": {"splunk": 3}}

The SIEM / SOAR Connectors section appears at the top of the Settings tab.

Each enabled connector shows:

• Status (Healthy / Error / Disabled)
• Push count and error count
• Last error message (if any)
• Send Test button

The retry queue line shows how many events are pending retry, with a Flush Now button to force immediate retry.

All three connectors require aiohttp for async HTTP. CNSL already lists this as a dependency. If it is not installed, connectors degrade gracefully (push returns False, events are queued but never sent).

pip install aiohttp