SIEM Integration

Alphyn streams its security telemetry directly into your Security Operations Center. Every runtime threat detected on a protected device and every management action performed in the Alphyn dashboard can be delivered to your SIEM in the format your analysts already work with, so Alphyn signals live alongside the rest of your security estate and drive the same correlation rules, dashboards, and incident workflows.

Integrations are configured per tenant in the Alphyn dashboard under Integrations. A tenant can run several sinks at once, each with its own delivery filter, so you can route the full stream to a central data lake while sending a focused subset to a downstream detection platform.

What flows to your SIEM

Alphyn emits two families of events. A single integration can carry either family or both.

THREAT events

Runtime device-security detections raised by the SDK on a protected device:

• Root / jailbreak - the device is rooted or jailbroken.
• Frida / hooking - a dynamic instrumentation or hooking framework is active.
• Emulator - the app is running on an emulator or simulator.
• Tamper / repackage - the app binary has been modified or re-signed.
• Malware - a known malicious package is present on the device.
• MITM - a man-in-the-middle condition is present on the network path.
• Device flag - a DEVICE_FLAGGED event marking a device against your device-flag policy.

AUDIT events

Management-plane actions performed in the Alphyn dashboard and API:

• Logins and MFA activity.
• API-key lifecycle changes.
• RBAC and role changes.
• Ruleset and integration configuration changes.
• Device unflag and other device-management actions.

The four sinks at a glance

Sink	Integration key	Format	Transport
Syslog CEF over TLS	syslog_cef	ArcSight CEF in an RFC 5424 frame	TLS
Splunk HEC	splunk_hec	Canonical Alphyn Security Event JSON	HTTPS
Microsoft Sentinel	sentinel	Azure Monitor Logs Ingestion records	HTTPS
QRadar LEEF over TLS	qradar_leef	IBM QRadar LEEF 2.0 in an RFC 5424 frame	TLS

Every sink authenticates the destination and encrypts the channel. The syslog sinks require TLS and optionally pin the SIEM’s CA and present a client certificate for mutual TLS. The HTTPS sinks authenticate with the destination’s own token or credential model.

Shared delivery filter

Each integration carries an optional delivery filter, applied uniformly across all sink types, so every destination receives exactly the slice of the stream it should:

Filter	Values	Behavior
filter_min_severity	INFO, LOW, MEDIUM, HIGH, CRITICAL	Events below the floor are not delivered. Device-flag events are exempt from the floor and always delivered.
filter_families	THREAT, AUDIT	Restricts delivery to the listed families. An empty list delivers both.
filter_apps	List of app package names	Scopes THREAT events to those apps. Audit events carry no package, so an app filter does not narrow the audit stream.
audit_include_business	true / false (default false)	When false, only security-plane audit events flow. Business-plane audit, such as subscription and billing activity, is delivered only when this is enabled.

Test connection and health

Every integration includes a Test connection action that delivers a synthetic test event through the real transport, so you can confirm the destination, credentials, and TLS chain end to end before any live traffic flows. A connector-health view then shows per-sink delivery counts and the last success and failure for each integration, giving you continuous visibility into the pipeline.

Field mapping

For SOC engineers building a parser, DSM, property mapping, or FlexConnector, the Parsing and field mapping page lists the complete CEF and LEEF field tables for both the THREAT and AUDIT families.