SIEM connector actions

Each Security Information and Event Management (SIEM) connection has the following set of available actions:

• Edit
• Delete
• Sync

Edit

The Edit action allows you to edit an existing SIEM connection. When selected, the Edit connector dialog is displayed:

You can perform the following from the Edit connector dialog:

• Edit the Name , Listener URL , and Authorization token value .
• Add additional HTTP/HTTPS headers to the connection by selecting + Header .

  note

  This option is only applicable to connectors using the generic format.

• Enable/disable the Apply to all customers option to apply the connector for all child workspaces linked to the channel workspace.

Select SAVE to save your changes.

Delete

The Delete action deletes the selected connector. The Delete connector? confirmation dialog is displayed:

Select YES, DELETE to delete the connector.

The connector is deleted from the channel workspace and all linked child workspaces.

Sync

When a SIEM connection is disconnected, Coro waits two hours before attempting to reconnect. During this time, no events are collected and sent to the SIEM provider from Coro. To reconnect manually, select the Sync action.

To access SIEM connector actions:

1. Select the three-dot menu to the right of the connection name:

   

   A list of available connection actions are displayed:

   

2. Select the desired action.