Modifying the Data of an SIEM Connector

You can modify the connector data for alerts, events, and audit that is sent to a third-party application.

Procedure

1. From the navigation pane, go to Manage > System.

   The System page appears.

2. Click the SIEM connector tile.

   The SIEM Connector page appears.

3. In the Connector name column, select a SIEM connector that you want to modify.

4. Modify the data on the details page.

   For the SIEM webhook connector, when a user modifies the webhook application, the user must also modify the template suitable for the particular application. For example, when a user changes the webhook application from Teams to Splunk, the user must change the templates of the log types to match Splunk application.