Sign in
Stable

Send BusinessProxy events into your SOC workflow

Export access, denied, routing and security events through signed HTTPS notifications and deterministic Syslog JSON/CEF adapter mappings.

Steps

Follow these in order.

  1. 01Events feed the SOC tools you already useAccess review should not depend on an administrator opening the dashboard. Event export gives SOC tooling the data needed for correlation, alerting and incident timelines.
  2. 02Signed, bounded and auditableEvent export should be treated as a security integration: signed payloads, replay-safe timestamps, sanitized fields and explicit retry/failure behavior.
  3. 03Integration feed, not UEBA or SOARBusinessProxy exports the signals; the customer SIEM, SOAR or data lake performs advanced analytics and response orchestration. Response APIs are planned separately and are not a completed SOAR platform.

Reference

Implementation details for setup and review.

Monitoring integrationSecurity teams need events where they already investigate incidents. BusinessProxy can deliver signed event notifications and provide stable mappings for SIEM collectors without pretending to be the SIEM.
  • Signed webhook delivery
  • Access and deny events
  • Routing and egress context
  • Syslog JSON / CEF mapping
Events feed the SOC tools you already useAccess review should not depend on an administrator opening the dashboard. Event export gives SOC tooling the data needed for correlation, alerting and incident timelines.
  • Who opened what: Private app launches, denied attempts and session context become machine-readable events.
  • Where traffic exited: Routing and region context helps explain why a work domain used a specific egress path.
  • Collector-friendly mapping: Syslog JSON and CEF mappings let teams feed existing collectors without waiting for a marketplace app.
Signed, bounded and auditableEvent export should be treated as a security integration: signed payloads, replay-safe timestamps, sanitized fields and explicit retry/failure behavior.
  • Payloads are signed for receiver verification.
  • Sensitive tokens and raw secrets are not exported.
  • Retries are bounded; after the retry budget the delivery is marked failed.
Integration feed, not UEBA or SOARBusinessProxy exports the signals; the customer SIEM, SOAR or data lake performs advanced analytics and response orchestration. Response APIs are planned separately and are not a completed SOAR platform.
  • Vendor-certified SIEM connectors are not included in V1.
  • Native syslog and OpenTelemetry transport are not included in V1.
  • Built-in UEBA and SOAR are not part of the product.