SIEM Integration for Pragatix AI Security
TranslationsBring AI security insights into the SIEM your team already uses
Pragatix streams security, audit, AI Gateway, agent, Shadow AI, anomaly, health, and delivery events into your existing SIEM over one secure, standards-based feed. No new console to learn, no proprietary agent to deploy, no change to the workflows your analysts already trust.
Validated SIEM platforms
These platforms were tested end to end against a live Pragatix deployment: events were delivered over TLS, parsed into fields, indexed, searched, and raised native alerts.
Graylog Open 7.1 FULLY VALIDATED Centralized search, dashboards, and alerting. Validated end to end with structured Pragatix events over TLS syslog, including retry and recovery. | Splunk Enterprise 9.4.14 FULLY VALIDATED Enterprise-scale security analytics. Validated through a syslog relay with a dedicated source type, indexed fields, dashboards, and alerts. | Wazuh 4.14.6 FULLY VALIDATED Open-source security monitoring. Validated on a single-node deployment with a Pragatix decoder, indexed fields, search, and native alert rules. |
Standards-based compatibility
Pragatix emits the industry formats these platforms already ingest, so they receive the same event stream through their standard syslog input.
IBM QRadar LEEF COMPATIBLE Receives Pragatix events in Log Event Extended Format over TLS-secured syslog. | OpenText ArcSight CEF COMPATIBLE Receives Pragatix events in Common Event Format over TLS-secured syslog. | LogRhythm CEF COMPATIBLE Receives Pragatix events using standards-based CEF over RFC 5424 delivery. |
These platforms support the required format and transport, and the serializers are validated. Native-console validation is not claimed, so a short interoperability test is recommended before production use. Any other RFC 5424, JSON, CEF, or LEEF receiver can be connected on the same basis.
Open standards. Secure delivery.
Secure transport TLS-SECURED TCP Events stay encrypted in transit from Pragatix to your SIEM, on port 6514 by default. Plaintext UDP is never used. | Standard delivery RFC 5424 SYSLOG The syslog standard your security tools, collectors, and relays already understand, with no custom connector to maintain. | Flexible formats JSON / CEF / LEEF Structured JSON for modern analytics, plus CEF and LEEF for established SIEM ecosystems. Choose per destination. |
Which host sends the events
The feed is emitted by the Windows application server, the one running the Admin Centre and Core API. Events from the Linux components reach your SIEM through that same server, so there is one sender to allow, not several.
The firewall rule your network team needs is therefore:
Source | Destination | Port | Direction |
|---|---|---|---|
Windows application server | Your SIEM collector |
| Outbound from the Pragatix server |
The complete firewall rule set for an on-premises deployment is on AI Security Suite POC Requirements (On-Prem).
What reaches your SIEM
One consistent event model covers the full picture of AI activity across your organization, and deliberately stops short of sensitive payloads.
Included in the event stream
| Never sent
The feed carries audit metadata and policy results, so your SIEM gains full visibility without becoming a second copy of sensitive content. |
Detail is configurable per destination. Warning, error, and critical security and health events are always available; informational service-health and lifecycle events are included only when Include operational information is enabled.
One SIEM, many environments and tenants
Every event carries the identity of where it came from, so a single SIEM can receive several Pragatix deployments and still keep them apart. Structured JSON events use schema version 1.1 and the stable schema ID ai_security.siem, and include the deployment ID, deployment name, environment type, product brand, product name, source host, and service name. Events owned by an account also carry the account ID and account name. CEF and LEEF carry the same identity fields.
That makes a cross-environment breakdown a single query:
Splunk: activity by deployment and tenant
index=main sourcetype="ai_security:siem:json" schema_id="ai_security.siem"
| stats count by deployment_name account_name product_brand family severityBecause the deterministic event ID includes the immutable deployment ID, identical source records from different deployments never collide in your index.
Set it up in the Admin Centre
1. Open the page Site administrators use Site Management > SIEM Integration. Account administrators with the Account Settings permission use Account Management > SIEM Integration. | 2. Add a destination Set the host, port, TLS server name, payload format, and severity filter. Site-wide destinations receive events from every account; account destinations receive only their own. | 3. Send a test event One click sends a warning-level audit event with a unique challenge ID, so transport, indexing, search, and alerting can all be confirmed in a single pass. | 4. Watch delivery Each destination reports successes over 24 hours and 7 days, failures and retries, pending count, oldest pending event, last success and failure, and TLS status. |
You can configure up to three site-wide destinations and up to three destinations per account. Each one keeps its own format, severity filter, TLS server name, retry state, and duplicate-safe outbox, so a receiver going offline delays delivery rather than losing events.
Keep sender and receiver clocks synchronized with NTP, and allow a small clock-skew window in recipient alert rules.
Bring your own SIEM
You supply and license your SIEM infrastructure; Pragatix delivers the events in the format it already understands. Talk to your Pragatix contact about connecting a platform that is not listed here, or about a proof-of-concept interoperability test.