Connect WiFi Security to Your SIEM
Stream ITDR alerts and authentication events to Splunk, Microsoft Sentinel, Elastic, QRadar, Datadog, or any SIEM. CEF format, webhook, or syslog. Configure in 5 minutes.
IronWiFi streams WiFi authentication events and ITDR threat detections to your SIEM in Common Event Format (CEF). Supported platforms include Splunk, Microsoft Sentinel, Elastic/ELK Stack, IBM QRadar, and Datadog. Events include MITRE ATT&CK technique IDs, risk scores, and full identity context. Setup takes approximately 5 minutes via webhook or syslog configuration.
Supported SIEM Platforms
Splunk
HTTP Event Collector (HEC) with CEF-formatted events. Pre-built search queries available.
Microsoft Sentinel
Log Analytics workspace ingestion via Data Collector API or syslog connector.
Elastic / ELK
Elasticsearch ingest via webhook or Logstash syslog input with CEF codec.
IBM QRadar
Syslog forwarding with automatic CEF parsing. QRadar DSM compatible.
Datadog
Webhook integration with Datadog Logs API. Custom facets for WiFi-specific fields.
Custom Webhook
Send events to any HTTP endpoint. JSON or CEF payload with custom headers and auth.
Architecture Overview
IronWiFi ITDR processes RADIUS authentication events in real time. When a threat is detected, scored, and mapped to MITRE ATT&CK, the event is forwarded to your SIEM via Cloud Tasks for reliable, at-least-once delivery.
RADIUS Event
Authentication request from access point
ITDR Analysis
5 detection engines score and map to ATT&CK
Cloud Tasks
Reliable delivery queue with retry logic
Your SIEM
Events arrive in CEF format via webhook or syslog
CEF Event Format
All events use the Common Event Format (CEF) standard for maximum SIEM compatibility. Here is an example ITDR detection event:
Event Types
- ITDR Threat Detections — credential attacks, impossible travel, MAC spoofing, brute force, privilege escalation (with MITRE ATT&CK technique IDs and risk scores)
- Authentication Events — successful and failed RADIUS authentications with full identity context (username, MAC, AP, SSID, auth method)
- Policy Violations — conditional access denials, certificate issues, VLAN assignment anomalies
- Administrative Actions — configuration changes, user management, policy updates
- Incident Lifecycle — incident created, updated, resolved, and response playbook execution events
Configuration Methods
Webhook (Recommended)
The fastest way to connect. Point IronWiFi to your SIEM's HTTP ingestion endpoint.
- Go to Console → Settings → Integrations → SIEM
- Select Webhook as the delivery method
- Enter your SIEM endpoint URL (e.g., Splunk HEC URL, Datadog Logs API)
- Add authentication headers (API key, Bearer token, or HEC token)
- Select event types to forward (ITDR alerts, auth events, policy violations)
- Click Test Connection to verify, then Save
Syslog
For SIEMs that prefer traditional syslog ingestion (QRadar, on-premise Splunk, rsyslog).
- Go to Console → Settings → Integrations → SIEM
- Select Syslog as the delivery method
- Enter your syslog server address and port
- Choose protocol: TCP+TLS (recommended) or UDP
- Select CEF or raw JSON format
- Click Test & Save
Configure in 5 Minutes
Most teams complete SIEM integration in under 5 minutes. No agents to install, no log collectors to configure. IronWiFi pushes events directly to your SIEM from the cloud. Events start flowing immediately after saving your configuration.
Start Streaming WiFi Events to Your SIEM
Connect IronWiFi ITDR to your security operations workflow. Free 14-day trial includes full SIEM integration.