Zoho Vault's integration with popular SIEM tools will allow organizations to manage all their Vault audit logs from the SIEM service of their choice. You can create custom alerts and receive instant or periodic notifications based on the configurations available in your SIEM service, to stay informed of all activities in your password manager. 

Prerequisite

• Super admin of Zoho Vault
  
• Valid subscription with the relevant SIEM tools
  

SIEM integration

Integrating with the SIEM services commonly involve two steps:

• Generating a token 
  
• Identifying the collector hostname 
  

Currently, we offer integration with seven SIEM solutions:

• Loggly
  
• Logz.io
• Sematext
  
• Sumo Logic
  
• Timber
  
• Microsoft Sentinel
  
• Datadog
  

Note

• By default, all audits captured in Zoho Vault will be sent to your SIEM service. To filter the audits sent, select Manage Syslog Configurations from SIEM Integrations in Vault. 
  
• We support only the HTTPS protocol at the moment.
  
• You can send logs only to one service at once. 
  

Integration with Loggly

1. Log in to your Loggly account, then select Source Setup from the menu bar.
   
   
   
   
2. Select Customer Tokens from the submenu.
   
3. A customer token is created by default. Copy this token for later use, or click Add New to use a new token with Zoho Vault.
   
   
   
   
4. To find out the Collector Hostname, select Source Setup, then click HTTP/S Event Endpoint.
   
5. Logs-01.loggly.com will be the hostname by default. If you've modified it, you can find the current URL from the field highlighted in the screenshot below. 
   
   
   

Configuring Loggly details in Vault

1. Log in to your Zoho Vault account as a super admin, then select Settings.
   
2. Select SIEM Integration, then click Edit configurations under Loggly.
   
3. Enter the Collector Hostname and token details, then click Save Configuration.
   
   
   
   
4. Click Enable.
   

Accessing Zoho Vault logs from Loggly

To view all audit logs from Vault in Loggly:

1. Log in to your Loggly account.
   
2. Click Search, then search for the logs from Vault based on the time and date of the operation.
   
   
   

Integration with Sematext

1. Log in to your account, then select Logs.
   
2. Click Create logs app.
   
   
   
   
3. Enter the App Name, then click Continue.
   
   
   
   
4. Select Actions, then click Integrations.
   
5. Scroll down to the section Where to send logs?.
   
6. Copy the hostname and index (token) details for later use. 
   
   
   

Configuring Sematext details in Vault

1. Log in to your Zoho Vault account as a super admin, then select Settings.
   
2. Select SIEM Integration, then click Settings under SemaText.
   
3. Enter the Collector Hostname and token details, then click Save Configuration.
   
   
   
   
4. Click Enable.
   

Accessing Zoho Vault logs from Sematext

To view all audit logs from Vault in Sematext:

1. Log in to your Sematext account.
   
2. Select the app you configured under Logs. 
   
   
   
   
3. View the total number of logs generated from Log counts, and details of all the logs generated from Log Events.
   
4. Click Search, then search for the logs from Vault based on the time and date of the operation.
   
   
   

Integration with Sumo Logic

1. Log in to your account, then select Manage Data.
   
2. Select Collections, then click Add Collector.
   
   
   
   
3. Select Hosted Collector as the Collector Type.
   
   
   
   
4. Enter a Name, then click Save.
   
5. Select Add Source corresponding to the newly created Collector, then select HTTP Logs and Metrics.
   
6. Enter a name for the source, then click Save.
   
7. Copy the URL generated for later use.
   
8. Click OK.
   
   
   

Configuring Sumo Logic details in Vault

1. Log in to your Zoho Vault account as a super admin, then select Settings.
   
2. Select SIEM Integration, then click Settings under Sumo Logic.
   
3. Enter the Collector URL, then click Save Configuration.
   
   
   
   
4. Click Enable.
   

Accessing Zoho Vault logs from Sumo Logic

To view all audit logs from Vault in Sumo Logic:

1. Log in to your Sumo Logic account.
   
2. Select Manage Data, then click Collections.
   
3. Select Open in Log Search from the newly created source to view the logs from Vault, based on the time and date of the operations.
   
   
   

Integration with Logz.io

1. Log in to your account, then select Send Your Data from the menu bar.
   
2. Select Libraries, then click Bulk HTTP/S.
   
3. Under URL for HTTPS, you’ll find the Collector Hostname. Copy the hostname as shown in the screenshot below. 
   
   Note: By default, your hostname will be listener.logz.io. 
4. Under Query string parameters, you’ll find the token details. Copy the token from the description.
   
   
   

Configuring Logz.io details in Vault

1. Log in to your Zoho Vault account as a super admin, then select Settings.
   
2. Select SIEM Integration, then click Settings under Logz.io.
   
3. Enter the Collector Hostname and token details, then click Save Configuration.
   
   
   
   
4. Click Enable.
   

Accessing Zoho Vault logs from Logz.io

To view all audit logs from Vault in Logz.io:

1. Log in to your Logz.io account.
   
2. Select Kibana to view the logs based on the time and date of the operation.
   
   
   

Integration with Timber

1. Log in to your account, then select Sources.
   
2. Click Add a New Source, then select Protocols.
   
   
   
   
3. Select HTTP API.
   
   
   
   
4. Under HTTP API settings, enter a Source Name, then click Next Step.
   
   
   
   
5. Copy the Source ID and API Key (Token) details for later use, then select Next Step. 
   
   
   

Configuring Timber details in Vault

1. Log in to your Zoho Vault account as a super admin, then select Settings.
   
2. Select SIEM Integration, then click Settings under Timber.
   
3. Enter the Source ID and token details, then click Save Configuration.
   
   
   
   
4. Click Enable.

Note: By default, the hostname will be logs.timber.io.

Accessing Zoho Vault logs from Timber

To view all audit logs from Vault in Timber:

1. Log in to your Timber account, then select Console.
   
2. Select the source name specified earlier from the dropdown box to view the logs from Vault, based on the time and date of the operation