Streaming audit logs to your SIEM

Overview

Common Room can continuously stream security audit events to infrastructure you own, so admin and sign-in activity lands in your SIEM alongside your other sources. Events arrive within minutes of occurring, with at-least-once delivery semantics. SIEM event streaming is available on Enterprise plans, and our team will work with you to complete setup.

We support stream delivery to a customer-owned AWS S3 bucket. Any SIEM that ingests from S3 (e.g. Splunk, Datadog, Microsoft Sentinel) can pick the data up from there.

Events are formatted using the Open Cybersecurity Schema Framework (OCSF), version 1.8.0, and delivered as gzipped newline-delimited JSON (ndjson.gz).

To get started, contact your Customer Success Manager or support.

What gets exported

We currently support the following events under the OCSF Identity & Access Management category. You may choose to enable only a subset of these events if required.

Sample record

One record per line, showing a teammate being granted the Editor role:

{
  "category_uid": 3,
  "class_uid": 3005,
  "class_name": "User Access Management",
  "activity_id": 1,
  "activity_name": "Assign Privileges",
  "type_uid": 300501,
  "time": 1784193641002,
  "severity_id": 1,
  "status_id": 1,
  "metadata": {
    "version": "1.8.0",
    "uid": "9f8b1c42-5d3e-5a17-9c04-7e2f61a8b930",
    "tenant_uid": "4821",
    "product": { "name": "Common Room", "vendor_name": "Common Room" }
  },
  "actor": { "user": { "uid": "7", "type_id": 1, "email_addr": "admin@acme.com" } },
  "user": { "uid": "88", "type_id": 1, "email_addr": "teammate@acme.com" },
  "privileges": ["Editor"]
}

metadata.uid is a stable identifier for the lifetime of an event. Use it as your deduplication key.

AWS S3 setup

1. [Customer] Configure an AWS S3 bucket and provide the Common Room team with:
   • Bucket name
   • AWS region
   • Bucket prefix for stream objects (e.g. siem/ is a good default)
   • Whether the bucket uses SSE-KMS
2. [Common Room] Using the details from step 1, we generate and share a least-privilege bucket IAM policy that lets our delivery role write to that prefix and nothing else.
   • If your bucket uses SSE-KMS, we also share a key policy statement — a bucket policy alone can't grant access to a KMS key, so without this second statement, our delivery role won't be able to write to the bucket.
3. [Customer] Add the policy (and key policy statement, if applicable) from step 2 to the bucket's permissions.
4. [Common Room] Enable stream delivery.

FAQ

What is the delivery file format?

Objects are gzipped newline-delimited JSON, with one OCSF record per line.

What is the delivery schedule?

Delivery happens in near-real-time: events are buffered briefly and flushed as a new object once a time or size threshold is reached, whichever comes first.

What are the delivery guarantees?

Delivery is at-least-once. The metadata.uid field is a stable identifier you can use for deduplication.

Which SIEMs can I use this with?

Any SIEM that can ingest from an S3 bucket. Most support this natively via an S3 or SQS-based input.