Universal SIEM Out-of-the-Box SecOps Integration
The Lumu Universal SIEM Out-of-the-Box integration allows you to centralize Lumu detections and operating events in your SIEM deployment. With this information in your SIEM, you will be able to use Lumu input as a pivot for:
- Incident response research
- Post-mortem investigation
- Threat hunting activities
Requirements
- A SIEM deployment with log ingest capabilities:
- Syslog
OR
- HTTP Collector
- An active Lumu Insights or Defender subscription.
- A Docker-enabled host with Docker compose support. This will be used for setting up the Lumu Universal SIEM integration tool.
Add Integration
- Log in to your Lumu account through the Lumu Portal and navigate to the integrations screen.
- Locate the Universal SIEM integration in the available apps area. Add the integration using the corresponding option to view more details. Familiarize yourself with the integration details available in the app description. Begin the activation process by clicking on the Activate button.
- Fill in the name of the integration. Then, click on Create.
- Once you create the integration, you will get the required information to setup the Universal SIEM integration tool.
Take note of the Integration Key. It will be needed for setting up the Universal SIEM integration tool.
Lumu Universal SIEM Integration tool
Now, it’s time to configure and deploy the Lumu Integration tool. Use the Universal SIEM repository link to open the Docker hub image repository. Based on your SIEM deployment, you will need to run some configurations according to the forwarding method you want to use. Please refer to your SIEM administrator or your SIEM vendor to obtain more information.
Choose one of the following methods to forward Lumu events:
- Syslog forwarding
- HTTP Collector
Syslog forwarding
Use this method if your SIEM supports event ingestion via Syslog. Lumu Universal SIEM can deliver Syslog messages in one of these formats:
- RFC 5424
- RFC 3164
RFC 5424
The RFC 5424 Syslog standard follows this format:
Here's an example of a Lumu RFC 5424 Syslog message:
The field values for the previous message are:
- PRI: 150
- VERSION: 1
- TIMESTAMP: 2026-04-17T12:11:26.346Z (ISO 8601 format)
- HOSTNAME: 78af70ae0d97
- APP-NAME: lumu-incs
- PROC-ID: 7
- MSGID: ceb204e8272c457d84af3499a15bb011
- STRUCTURED-DATA MESSAGE: {"IncidentUpdated": ...}
RFC 3164
The RFC 3164 Syslog standard follows this format:
A Lumu RFC 3164 Syslog message looks as follows:
The field values for the previous message are:
- PRI: 150
- TIMESTAMP: Apr 17 13:17:53 (3-letter month day 24-hour:minutes:seconds UTC)
- HOSTNAME: 6d2b4d9e1293
- TAG: lumu-incs
- PID: 7
- MESSAGE: {"IncidentUpdated": ...}
Usage
1. Prepare the container (replace VALUE with proper values):
docker create \
-e CUSTOM_OUTPUT="syslog_proto" \
-e INCLUDE_MUTED_UPDATES=VALUE \
-e EVENTS=VALUE \ -e COMPANY_KEY=VALUE \
-e OUTPUT_SERVERS=VALUE \
-e SYSLOG_RFC=VALUE \
--restart unless-stopped \
--name lumu-universal-siem \
--log-opt tag=lumu-universal-siem \
--log-opt max-size=100m \
--log-opt max-file=1 \lumutools/universal-siem:latest2. Run it:
docker start lumu-universal-siem
Parameters
- COMPANY_KEY: Lumu integration key
- INCLUDE_MUTED_UPDATES: Set this to true if you want to include contacts of muted incidents, false otherwise (default is false)
- OUTPUT_SERVERS: Syslog server information (PROTO:IP_HOSTNAME:PORT)
- SYSLOG_RFC: RFC to use for forwarding events. Select between 3164 or 5424
- EVENTS: comma-separated list of events to send to the Syslog server. You can skip this parameter if you want to send all the events. Use the available values: NewIncidentCreated, IncidentUpdated, IncidentUnmuted, IncidentMuted, IncidentClosed, IncidentIntegrationsResponseUpdated, IncidentBuiltInResponseUpdated, IncidentActionAdded, IncidentMarkedAsRead, IncidentCommentAdded. If this variable is not set, all message types are accepted.
Review the Lumu event reference section for detailed information on the Lumu events you can select.
HTTP collector
Use this method if your SIEM supports event collection via HTTP collection. The SIEM exposes an HTTP URL where the forwarder injects data with POST Web requests.
Before you start
First, create the Lumu HTTP collector in your SIEM deployment. If your SIEM requires to send the Web requests with query parameters, a particular body format, or specific headers, create and configure the .env_ auxiliary files as follows:
.env_headers
If you need to set specific HTTP headers, create the .env_headers file using this structure:
Within the JSON in the APP_HEADERS variable, define the required headers as a key: value pair.
.env_body
If you need to set a specific HTTP request body format, create the .env_body file using this structure:
APP_BODY='[
{
"key_1": "value_1",
...,
"key_n": "value_n"
"message": "{{LUMU_EVENT}}",
}
]'
APP_ESCAPE_LUMU_EVENT=0 # 1|0, If you need to quote Lumu event as string
APP_REPLACE_LUMU_EVENT=1
Some considerations:
- Add the required fields within the HTTP body in key: value pairs. To add the message to the payload, use the string {{ LUMU_EVENT }}
- The APP_ESCAPE_LUMU_EVENT must be set to 1 if you need to send it as a string. 0 to send it as JSON
- If you don't add the {{ LUMU_EVENT }} string within the APP_BODY, Lumu events will not be part of the HTTP request's body
.env_queries
If you need to set query parameters for the HTTP request, create the .env_queries file using this structure:
"param1":"value1",
"param2": "value2"
}'
Add each required query parameter as a key: value pair.
Usage
1. Prepare the container (replace VALUE with proper values):docker create \-e CUSTOM_OUTPUT="custom_http" \-e COMPANY_KEY=VALUE \-e INCLUDE_MUTED_UPDATES=VALUE \-e EVENTS=VALUE \-e APP_VERBOSE=VALUE \-e CUSTOM_FULL_URL=VALUE \-v $(pwd)/.env_headers:/app/.env_headers \-v $(pwd)/.env_body:/app/.env_body \-v $(pwd)/.env_queries:/app/.env_queries \--restart unless-stopped \--name lumu-universal-siem \--log-opt tag=lumu-universal-siem \--log-opt max-size=30m \--log-opt max-file=3 \lumutools/universal-siem:latestIf you don't need to define custom parameters for a particular HTTP request attribute, remove the corresponding line from the previous command.
2. Run it:
docker start lumu-universal-siem
Parameters
- COMPANY_KEY: Lumu integration key.
- INCLUDE_MUTED_UPDATES: Set this to true if you want to include contacts of muted incidents, false otherwise (default is false).
- CUSTOM_FULL_URL: Receiver URL given by the SIEM.
- EVENTS: comma-separated list of events to send to the Syslog server. You can skip this parameter if you want to send all the events. Use the available values: NewIncidentCreated, IncidentUpdated, IncidentUnmuted, IncidentMuted, IncidentClosed, IncidentIntegrationsResponseUpdated, IncidentBuiltInResponseUpdated, IncidentActionAdded, IncidentMarkedAsRead, IncidentCommentAdded. If this variable is not set, all message types are accepted.
Review the Lumu event reference section for detailed information on the Lumu events you can select.
General recommendations
For the proper operation of the integration, follow these recommendations:
- Integration between Lumu and your SIEM relies on a stable network connection, including the Internet. Make sure the following hosts are reachable:
- SIEM collector/endpoint.
- defender.lumu.io.
- Docker hosts
- HTTP, HTTPS, and WSS are required.
- Do not stop the Docker container. Doing this will interrupt the event forwarding process. Events generated with a halted container will not be forwarded to your SIEM.
Lumu event reference
Use this table to build the comma-separated string to include Lumu events of interest in the Universal SIEM component configuration.
| Event Code | Description |
| NewIncidentCreated | Lumu reported a new detection |
| IncidentUpdated | Lumu reported a new event related to an existing detection |
| IncidentClosed | A Lumu detection was manually or automatically closed |
| IncidentMuted | A Lumu detection was muted by an analyst |
| IncidentUnmuted | A previously muted detection was re-activated |
| IncidentIntegrationsResponseUpdated | External integrations acknowledged/responded to the incident |
| IncidentBuiltInResponseUpdated | Lumu's built-in response mechanisms (e.g. agent) were applied |
| IncidentActionAdded | A manual action (e.g. sharing a report) was performed on the incident |
| IncidentMarkedAsRead | The Lumu detection was read. |
| IncidentCommentAdded | A comment was recorded on the Lumu detection |
For example, if you are interested in new detections and new events on existing detections, you must use the following:
"NewIncidentCreated,IncidentUpdated"
If you want to add the status change to the Lumu-reported events, you must use the following:
"NewIncidentCreated,IncidentUpdated,IncidentMuted,IncidentUnmuted,IncidentClosed"
Other implementations
Here, you find some uses of the Universal SIEM integration with particular SIEMs:
Get an AI Summary
Related Articles
Sumo Logic and Lumu Universal SIEM
Remember to add the Universal SIEM Out-of-the-Box SecOps Integration before proceeding. Lumu Universal SIEM can be used to deliver Lumu detections and operating events to a Datadog deployment leveraging its HTTP Custom log forwarding feature. ...FortiSIEM and Lumu Universal SIEM
Remember to add the Universal SIEM Out-of-the-Box SecOps Integration before proceeding. Lumu Universal SIEM can be used to deliver Lumu detections and operating events to a FortiSIEM deployment using HTTP(S) POST requests. This article details the ...Slack Out-of-the-Box SecOps Integration
Requirements A Slack Free or above subscription An Active Lumu Insights or Lumu Defender subscription Configure Slack Incoming Webhook 1. Create a Slack app. In your Slack page, click on the three dots and select the “Automations” option. 2. Click on ...Microsoft Teams Out-of-the-Box SecOps Integration
Requirements Microsoft Teams A Microsoft Teams Essentials subscription or above An Active Lumu Insights or Lumu Defender subscription Incoming Webhooks connectors will be retired by Microsoft. We strongly advice to migrate to the Webhook model. You ...Datadog and Lumu Universal SIEM
Remember to add the Universal SIEM Out-of-the-Box SecOps Integration before proceeding. Lumu Universal SIEM can be used to deliver Lumu detections and operating events to a Datadog deployment leveraging its HTTP Custom log forwarding feature. ...