Connected sources

A connected source brings a SIEM’s alerts into AarView, in that SIEM’s native format. AarView converts them to one common shape and they join the incidents, dashboards and SOAR rules.

Supported products

Product	Push	Pull
Wazuh	yes	yes
Elastic Security	yes	yes
OpenSearch Security Analytics	yes	yes
Splunk	yes	no
IBM QRadar	yes	no
Microsoft Sentinel	yes	no
Graylog	yes	no
AarView generic format (JSON)	yes	no

The generic format is for any tool that can send JSON: see Machine API.

Create a source

In AarView, Connected sources menu, create a source for your product. Only the super administrator creates, changes, rotates or removes a source, with a sign-in less than 10 minutes old. Creating requires the licence; receiving never does.

Each source belongs to one client: its alerts go to that client only. The client is never read from the received content; the source fixes it.

Push mode

The SIEM sends its alerts to AarView.

1. On creation, AarView gives an intake address and a client ID with its secret. The secret is shown once.
2. Set them in your SIEM’s webhook or forwarder.
3. You can restrict the source to given origin networks: a request from anywhere else is refused.

The intake address is https://<your domain>/api/v1/ingest/source. The ID and secret go in the X-AarView-Client-Id and X-AarView-Client-Secret headers, or in HTTP Basic authentication:

curl -sS https://aarview.example.org/api/v1/ingest/source \
  -H "X-AarView-Client-Id: avc_..." \
  -H "X-AarView-Client-Secret: avs_..." \
  -H "Content-Type: application/json" \
  --data @alert.json

The secret can be rotated at any time. Removing a source stops its credential; alerts already received stay.

What intake accepts

• One alert, a list of alerts, or the product’s own envelope (for example an Elastic connector’s list of alerts, or the value of a Sentinel response).
• 100 alerts at most per request, and 5 MB at most per request.
• A volume cap per source: 1,000 events a minute by default, adjustable on the source’s card. A request that would cross the cap is refused whole (HTTP 429, with the time before retrying) and counted on the card.

The answer says what was received, created, recognised as a duplicate, filtered or rejected.

Pull mode

AarView itself reads new alerts from an Elasticsearch or OpenSearch based SIEM: Elastic Security, OpenSearch Security Analytics, Wazuh.

Setting	Value
Address	the search engine’s URL
Index	by default .alerts-security.alerts-default (Elastic), .opensearch-sap-*-findings* (OpenSearch), wazuh-alerts-4.x-* (Wazuh)
Time field	by default @timestamp (Elastic) or timestamp (OpenSearch, Wazuh)
Authentication	username and password, or API key
Certificate check	on by default; the card warns when it is off
Interval	from 30 seconds to 1 hour
History to import	none, 24 hours or 7 days

• Test the connection before creating the source: on failure, AarView gives the engine’s own reason (password, refused certificate, missing index, timeout).
• The connection secret is stored encrypted, bound to its source.
• A source’s connection can be edited without deleting it.
• Reading stops two minutes before the present: an alert your SIEM indexes late is not skipped.

Severity

AarView grades every alert on four levels: low, medium, high, critical.

• An unknown severity becomes medium, never low.
• For Wazuh: level 7 and above, medium; 12 and above, high; 15 and above, critical.
• Each source has a minimum severity: below it, the alert is filtered and counted.

Duplicates and observables

• An alert’s reference is the product’s own id, or failing that a hash of the content. Sending the same alert again does not create a second incident.
• Observables (addresses, domains, hashes, accounts) are extracted, bounded and deduplicated. None is marked as an indicator of compromise automatically: that is an analyst’s decision.

Preview and health

• Preview: paste a sample and see what AarView would make of it, without storing anything. For a pull source, pull test: one read, nothing stored.
• Each source shows its state:

State	Meaning
healthy	alerts are arriving
waiting	nothing received yet
silent	nothing for too long: 24 hours for a push source, three missed rounds for a pull source
error	the latest event is an error, with its reason
disabled	the source is switched off

A silent source usually means a broken forwarder. The team can be told when a source fails or goes silent (Settings, Notifications).