Configuring SIEM Streaming

Configure SIEM streaming to send DaVinci events to a webhook configured in PingOne.

About this task

After you configure the PingOne webhook, it receives DaVinci events. These events are not affected by the logging level in the flow. The events use the payload structure described below.

This is not a real-time service. There can be a delay between when the DaVinci event occurs and when it appears in PingOne or in a third-party service.

Steps

Sign on to PingOne.
Create a new webhook as described in the PingOne documentation.

In the Event types list, select the DaVinci event type.

SIEM streaming payload structure

SIEM streaming events use the payload structure and properties described here.

Event Types

These event types generate a payload.

Custom Analytics

This event is sent by a Flow Analytics connector node within a flow. This node can be configured to send information about the flow outcome.

Start Interaction

This event is sent when a flow execution starts. It can be used to count the number of flow invocations during a particular time period.

Receive Request

This event is sent when a connector receives an event. It contains information about the capability to be used and its required inputs.

This event type is currently in limited release. To request access to this event type, open a support case.

Send Response

This event is sent after a connector has successfully executed a capability. It contains output information from the capability that successfully ran.

This event type is currently in limited release. To request access to this event type, open a support case.

Send Error Response

This event is sent after a connector has failed to execute a capability. It contains information about the error.

Payload Structure

All events use this payload structure.

{
  "id" : "payload ID",
  "recordedAt" : "timestamp",
  "correlationId" : "correlation ID",
  "action" : {
    "type" : "DAVINCI_INTERACTION.interaction_type",
    "description" : "description"
  },
  "resources" : flow ID",
    "type" : "DAVINCI_INTERACTION",
    "name" : "flow name",
    "environment" : {
      "id" : "company ID"
    }
  } ],
  "result" : {
    "status" : "status"
  },
  "_embedded" : {
    "flowInteractionEvent" : {
    	// Actual Davinci Event Payload
    }
  }
}

Table 1. Event Properties
Property	Description
`id`	A unique identifier for the event payload.
`recordedAt`	The UTC timestamp when the event was recorded.
`correlationId`	A correlation ID for the event.
`action.type`	The type of event. Valid values are `START_INTERACTION`, `RECEIVE_REQUEST`, `SEND_RESPONSE`, and `SEND_ERROR_RESPONSE`.
`action.description`	A description of the event type.

Table 2. Resource Properties
Property	Description
`id`	The flow ID.
`type`	The type of interaction. All events currently have a type of `DAVINCI_INTERACTION`.
`name`	The flow name.
`environment.id`	The company ID.

Table 3. Result Properties
Property	Description
`status`	The result status. Valid values are `SUCCESS` and `FAILURE`.
`description`	A description of the response. This property is only present for `SEND_RESPONSE` events.

Property Description

eventMessage

The event type. Valid values are StartInteraction, Receive Request, Send Response, and Send Error Response.

companyId

The company ID.

interactionId

A unique identifier for the flow execution.

flowVersionId

The flow version ID. If the version ID is not available, the value is -1.

identity

The service that generated the event.

tsEms

The UTC timestamp when the event completed in DaVinci.

flowID

The ID of the flow.

flowName

The name of the flow.

ID

The node ID.