SIEM Alert Forwarding

Suricatavel includes a SIEM Forwarding Subsystem to stream Suricata events, alerts, and enriched threat intelligence to external Security Operations Centers (SOCs).

The system operates with local buffering, automated retries, and encrypted transport channels, and can defer transmission until threat intelligence is compiled.

---

Supported protocols and formats

Configure output channels utilizing the following standards:

Format	Transport	Common Downstream Systems
JSON	TCP, TCP+TLS, UDP	Wazuh, Logstash, Elastic, Sentinel
Common Event Format (CEF)	TCP, TCP+TLS, UDP	Micro Focus ArcSight
Log Event Extended Format (LEEF)	TCP, TCP+TLS, UDP	IBM QRadar
RFC 5424 (Syslog)	TCP, TCP+TLS, UDP	Standard Syslog Receivers, Rsyslog
Splunk HEC	HTTP, HTTPS	Splunk HTTP Event Collector

---

Setup flow

To establish a SIEM destination:

1. Navigate to Settings > Forwarding.
2. Click Add destination.
3. Fill out the core output details:
   • Name: A distinct identifier (e.g., Production Wazuh Collector).
   • Format: Select from JSON, CEF, LEEF, RFC5424, or Splunk HEC.
   • Protocol: Choose TCP, TCP+TLS (encrypted), or UDP.
   • Host / Port: Enter the network socket details of your SIEM receiver.
   • Forwarding Mode: Set to Global to send all alerts automatically, or Policy to only forward via automated policy triggers.
4. (Optional) Configure TLS settings:
   • If using TCP+TLS, upload your Client Certificate (.pem / .crt) and Client Key (.pem / .key).
   • If using Splunk HEC, set your HEC Token
   • Toggle Verify Peer to strictly validate the certificate chain, or Allow Self-Signed if using local certificates.
5. Click Test connection to immediately verify reachability from the Suricatavel server.
6. Once validated, click Save.

---

Advanced feature: Deferred enrichment forwarding

To ensure your downstream SIEM dashboards receive full threat intelligence metadata immediately, enable Deferred Forwarding:

1. In the output configuration, toggle Include enrichment to true.
2. Toggle Wait for enrichment to true.
3. Set the Enrichment timeout (default: 120 seconds).

---

Downstream integrations (Deployment templates)

Suricatavel includes pre-configured integration templates that you can download directly from the SIEM output card in your Admin Panel after saving:

A. Wazuh decoders

• Setup: Download the wazuh-decoder-suricatavel.xml template.
• Action: Copy the contents into your Wazuh Manager’s custom decoders directory:

  sudo cp wazuh-decoder-suricatavel.xml /var/ossec/etc/decoders/local_decoder.xml
  sudo systemctl restart wazuh-manager

B. Splunk Technology Add-on

• Setup: Download the TA-suricatavel.tar.gz Splunk Technology Add-on.
• Action: Install it in your Splunk instance.

---

Background processes and reliability

To guarantee high throughput and zero alert loss during network latency or SIEM outages, Suricatavel manages background daemon queues.

CLI health checks

Inspect health states of all SIEM destinations:

# Force-refresh the reachability status of all SIEM destinations
php artisan suricatavel:refresh-siem-health