Entra
AWS
Kubernetes
Salesforce
Integrations
SentinelOne AI SIEM Integration
Privileged changes and Hydden risk findings reach SentinelOne as alerts analysts can act on.
All product updates
Security
SOC Enrichment With Identity Events
Send the identity activity Hydden records to the SIEM your security team already watches, and choose which kinds of events go there.
Key benefits
Analysts work in the SIEM. When identity activity stays in a separate tool, the account changes and sign-ins behind an alert are one more place to look, and often nobody looks.
Hydden can now forward the activity events in your tenant to an external SIEM. You pick all events or only the kinds you care about, and each destination shows when it last received events and the last error, so you know the feed is working.
How it works
1. Add a destination
Bind it to a connector that can send event batches, on the External SIEM page.
2. Choose the events
Send every event, or only the kinds your analysts need.
3. Watch the feed
Each destination shows its last delivery and its last error.
Getting started
Event forwarding is part of Hydden for all customers. Open the External SIEM page in the Connectors settings to add a destination.
Need configuration detail? Technical documentation is available to customers after sign-in.
Related updates
All updatesIntegrations
Hydden Identity Data In Cortex XSIAM
Analysts and agents in Cortex pull Hydden identity data on demand.
Search and reporting
Explore And Events
Browse accounts, owners, groups and roles in one place, and read activity as plain sentences.
Put identity activity in front of your analysts
Request a trial and forward Hydden events to your SIEM.