Vrymdor™Send your Vrymdor audit trail to your SIEM
Your SIEM (Splunk, Microsoft Sentinel, Datadog, Elastic or any tool that can call a web address) pulls your workspace's audit trail from Vrymdor. Nothing in your network has to accept a connection from us.
1. Create a feed token
In the dashboard, open Settings, SIEM feed, give the token a name (for example "Splunk") and press
Create token. Copy the token straight away: it starts with vrya_ and is shown only once. It can read
your workspace's audit trail and nothing else. Revoke it on the same page at any time.
2. Point your SIEM at the feed
| Setting | Value |
|---|---|
| Address | https://app.vrymdor.com/api/v1/audit/feed |
| Method | GET |
| Header | Authorization: Bearer <your vrya_ token> |
| Query | cursor=<next_cursor from the last answer> and limit=500 (at most 1000) |
| Poll every | 1 to 5 minutes |
Each answer has events in the order they happened, a next_cursor to send next time, and more: true
when another page is waiting (ask again straight away). Keep the last next_cursor your SIEM received, so
a restart continues where it stopped and no event is read twice.
3. Try it from a terminal
curl -s -H "Authorization: Bearer $VRYMDOR_FEED_TOKEN" "https://app.vrymdor.com/api/v1/audit/feed?limit=5"
What each event holds
id, occurred_at, action, entity_type, entity_id, the actor's name, email, title and authority at
the time, the reason when one was given, and the event's details. Internal ids of people are never sent.