Changing the SIEM configuration of an organisation¶

Note

The body must include the attributes id and modified to identify the corresponding entry.

Note

The ID of the entry in the path of the request must match the value of the attribute id in the body.

Sends a PATCH request to the endpoint /organisations/{organisation}/siem.

Description¶

The Change-Organisation-SIEM request changes the SIEM connection details of an organisation.

Requirements¶

Values of the request: Organisation ID {organisation}

Objects: OrganisationVO

Request¶

To change the SIEM connection details, add the Organisation ID {organisation} to the path of the request.

For a detailed specification of which information is required to change the SIEM connection details, an object OrganisationVO with the following attributes must be defined in the body:

Attributes	Description	Values
`id`	The ID of the entry.	`integer`
`modified`	The last modification date in ISO 8601 format.	`string($date-time)`

The following attributes are optional:

Attributes	Description	Values
`siemProvider`	The name of the SIEM provider (for example splunk).	`string`
`siemConnectionDetails`	The connection details for the SIEM provider.	`object`

In response, the system returns the object OrganisationVO with the updated information.

The object provides the following information:

Attributes	Description	Values
`id`	The ID of the organisation.	`string`
`name`	The name of the organisation.	`string`
`created_at`	The original creation time.	`string($date-time)`
`updated_at`	The time of the last update.	`string($date-time)`
`users`	The users assigned to the organisation.	`array`
`showReports`	Defines whether mitigation reports are enabled.	`true` `false`
`siemEnabled`	Defines whether the SIEM integration is enabled.	`true` `false`
`customer_id` (if customer references enabled)	The identifier of the customer reference.	`string`
`customer_reference` (if customer references enabled)	The grouped customer reference.	`string`

Example¶

Example request body:

{
  "siemProvider": "string",
  "siemConnectionDetails": {
    "host": "string",
    "port": 0,
    "apiToken": "string"
  }
}

Responses¶

The following responses are available:

STATUS CODE	DESCRIPTION
200	The request has succeeded.
401	The request has not succeeded because the user authentication was incorrect.
403	The request has not succeeded because the user does not have the right permissions.
422	The request was unsuccessful because the submitted data could not be processed.