Configuration

Immediately save the key in a safe location, like a secrets manager or a password manager. After you navigate away from the API Keys page, you will not be able to access or copy any API keys again.

Only users with Super Admin role are able to access API keys after they have been created and the page is exited.

Super Admin users can copy any active or expired API key by clicking the copy icon in the API key’s “Actions” column.

Models

Proxy Configuration (PAC)

Download Scripts

SIEM Integrations

Connection Settings

Choose your SIEM Platform from the drop-down.

Fill in all the data fields for your SIEM Platform.

The most common required fields include:

URL: Enter the endpoint into the URL field.
Authentication Token.
Sync Frequency: Enter the number of records you want to be sent per synchronization.
Splunk requires a Splunk Index. The index must be created before configuring Splunk as your SIEM.
Google SecOps: The URL must include the following query parameters:

Key: Your Google SecOps API key
Secret: Your SecOps API secret
Example: https://your-instance.googleapis.com/v1/endpoint?key=my-secops-key&secret=my-secops-secret

SIEM Data Integration

Choose one radio button to forward Prompts & Alerts or Alerts Only to your SIEM.

Additional data options:

Check any boxes next to your desired data and formats listed.

Include Audit Logs to send Audit Logs to your SIEM. Documentation here.

JSON Lines Format: Documentation here.

Include Sanitized Prompt: This will send the redacted version of prompts to your SIEM. Documentation here.

Include Raw Prompt and Response: This will send the original version of prompts and responses, that include sensitive data to your SIEM. Documentation here.

Include LLM Response: Choosing this option

Click Save.

SIEM Events Schema

Event schema and data details are available at: Administrator Guide, Data Dictionary.

Exabeam Additional Details

The Exabeam Webhook Cloud Collector documentation is here.

Enter your preferred URL based on your Region. The Exabeam list of Regions for Cloud Collectors is here.

Splunk Additional Details

The Splunk steps are near-identical to the steps for Exabeam. The Splunk HTTP Event Collector (HEC) documentation is here.

Amazon S3 Details

When Amazon S3 is selected as the SIEM Platform, the Amazon S3 Configuration section displays the following fields:

S3 Bucket Name: Enter the name of the destination S3 bucket.
IAM Role ARN: Enter the IAM role that WitnessAI will assume to write logs to your S3 bucket.
AWS Region: Enter the AWS region where your S3 bucket is located.
External ID: Used in the IAM role trust policy to verify WitnessAI’s identity. Click the copy icon to copy the value.

Your organization will need to create a AWS External ID, and a role that allows writing to the S3 bucket. Creating an External ID requires an AWS ID from the external entity that needs to write to your S3 bucket.
Contact WitnessAI Customer Success to request the correct AWS ID for your dedicated WintessAI deployment.
Learn more at Amazon Web ServicesHow to Use External ID When Granting Access to Your AWS Resources | Amazon Web Services

Prefix: Enter the S3 key prefix (folder path) for organizing log files within the bucket.
Session Name: Optional name for the STS session used when assuming the IAM role.
Sync Frequency: Enter the number of items to send per sync.

Click Save.

Configuration API Keys Models Proxy Configuration (PAC)Download Scripts SIEM Integrations Connection Settings SIEM Data Integration SIEM Events Schema Exabeam Additional Details Splunk Additional Details Amazon S3 Details