Setting up integration with a SIEM application

To view and analyze Absolute events in your SIEM application, download, install, and configure the Absolute SIEM Connector.

Learn more about integrating with a SIEM application

The Absolute SIEM Connector can be installed on a computer running any of the following operating systems:

  • Windows Server®:

    • Windows Server 2022

    • Windows Server 2019

  • Windows:

    • Windows 11 (64-bit)
    • Windows 10 (32- and 64-bit)

The following requirements must also be met:

  • At least 10 MB of free disk space
  • .NET Framework 4.0 or higher

There are no specific CPU or RAM requirements for Windows or Windows Server.

  • The syslog server and the computer on which you intend to install the SIEM Connector reside within the same network.
  • An Internet connection is available.
  • .NET Framework 4.0 is installed on the computer on which you intend to install the SIEM Connector.

To download and install the SIEM Connector:

  1. Log in to the network computer on which you want to install the SIEM Connector.
  2. Log in to the Secure Endpoint Console as a user with Manage permissions for SIEM integration. The System Administrator role is the only Default role with this permission.

  3. To authenticate the communication between the SIEM Connector and your SIEM application, you need to generate an API token and then upload the API token file during the SIEM Connector installation process:

    1. Complete the steps to create an API token file.

      Ensure that you assign the Manage permission for SIEM integration to the token.

    2. Download the file to your computer.
  4. On the navigation bar, click Settings > SIEM integration.

  5. Under Step 1: Install the SIEM Connector, click Download SIEM Connector. The AbsoluteSiemConnector<x.x>.zip is downloaded.

    The variable <x.x> is the version number of the Connector (for example, 3.0).

  6. From the location where zip file was downloaded, extract its contents to a location of your choice. The zip file contains the following files:

    • AbsoluteSiemConnector<x.x>.msi: MSI installer for the SIEM Connector

    • AbsoluteSiemConnector<x.x>.checksums: file containing the SHA-256 hash of the installer

      You can use a hash verification tool, such as CertUtil, to verify that the contents of the AbsoluteSiemConnector<x.x>.msi installer have not been altered during download. For more information about CertUtil, see Microsoft documentation.

  7. Install the SIEM Connector:

    1. On the network computer, navigate to the location of the AbsoluteSiemConnector<x.x>.msi file and double-click it.
    2. On the Welcome page of the Absolute SIEM Connector Setup Wizard, click Next.
    3. Review and accept the terms and conditions of the End-User Service Agreement and click Next.

    4. On the Destination Folder page, do one of the following:

      • To install to the default folder shown in the field, click Next.
      • To install to a different folder, click Change, navigate to and select the applicable folder on your local drive, and then click OK.

    5. On the API token configuration page, do the following:

      1. Next to the Token File field, click Browse and navigate to and select the API token file (.token) that you downloaded in step 3.

      2. To encrypt the token ID and secret key, generate a .key file by clicking the Encryption Key field and entering a value up to 256 characters in length. Any combination of characters, numbers, and symbols is supported.

        The SIEMEncryptionKey.key file is stored in C:\Users\<userprofile>\AppData\Local\Absolute SIEM Connector. Do not delete this file.

      3. In the Update Interval field, enter how frequently you want the SIEM Connector service to check for new events in Absolute. You can set the interval to any value between 5 minutes and 1440 minutes (24 hours). The default interval is 60 minutes.
      4. Click Next. The system validates the API token.

    6. On the Syslog server configuration page, do the following:

      1. Enter the Hostname of the syslog server.
      2. Enter the Port number for syslog messages.

      3. Select the TCP or UDP protocol.

        The TCP protocol is recommended as it is more reliable than UDP.

      4. Click Next.
    7. On the Ready to install Absolute SIEM Connector page, click Install and wait for the installation to finish.

    8. Click Finish. The SIEM Connector is installed.

    If you need to update the SIEM Connector configurations after the Connector is installed, use the Uninstall or change a program feature in Windows Settings > Apps to open the Absolute SIEM Connector Setup Wizard. You can then edit the applicable configurations. For more information about updating programs, see Windows documentation.

Configuring the integration consists of selecting the events to send to your SIEM application and enabling (or disabling) the integration.

  1. Log in to the Secure Endpoint Console as a user with Manage permissions for SIEM integration. The System Administrator role is the only Default role with this permission.
  2. On the navigation bar, click Settings > SIEM integration.
  3. If the SIEM integration is currently disabled, under Step 2: Configure the integration, click OFF to toggle the switch to ON. The integration is enabled.

  4. Click View events.

    The list of Absolute events that you can send to your SIEM application shows in the grid.

  5. Select the checkbox next to each event that you want to send to your SIEM application. To find an individual event in the list, enter a keyword in the Search field. The search results update dynamically as you type.

    To select all events, select the checkbox next to the Search field.

  6. [Optional] When you are finished, review your selections by clicking Hide unselected. To show all events again, click Show unselected.
  7. Going forward, Absolute may release new features and functionality that introduce new event types. To ensure that the events associated with each new event type are sent to your SIEM application, select the checkbox next to Automatically select all new event types.
  8. Click Save. The integration is configured. The number of selected events shows above the grid next to Selected events.

  1. Log in to the Secure Endpoint Console as a user with Manage permissions for SIEM integration. The System Administrator role is the only Default role with this permission.
  2. On the navigation bar, click Settings > SIEM integration.

  3. Under Step 2: Configure the integration, do one of the following:

    • To enable the integration if it is disabled, click the switch to set it to ON. The system starts sending events from your Absolute account to your SIEM application.
    • To disable the integration if it is enabled, click the switch to set it to OFF. The system stops sending events from your Absolute account to your SIEM application.

From time to time, a new version of the SIEM Connector is made available in the Secure Endpoint Console. It's best practice to upgrade the Connector when a new version is released.

To upgrade the SIEM Connector, download and install the new version of the Connector. The new version automatically overwrites the old version.

Do not uninstall the old version of the Connector before installing the new version. This action causes duplicate events (for the five days prior to the upgrade) to be sent to your SIEM solution.

Also note the following:

  • You'll need to generate a new API token. Ensure that you assign the Manage permission for SIEM integration to the token.
  • The new Connector automatically applies the event configurations set under Step 2: Configure the integration. There is no requirement to reconfigure them.