SIEM Push
SIEM push streams ANTS Platform events to your SIEM over HTTP Event Collector (HEC), the ingestion interface used by Splunk and supported by CrowdStrike Falcon Next-Gen SIEM. Events arrive within seconds of being recorded, so analysts can search, correlate and alert on AI activity next to the rest of your security data.
| Destinations | CrowdStrike Falcon Next-Gen SIEM, Splunk, and other SIEMs and pipelines that accept HEC |
| Event types | AI events, endpoint events, alerts, audit logs. You choose which to send. |
| Identifiers | Every event carries the user and device identifiers ANTS Platform knows, including the CrowdStrike Falcon agent ID |
| Delivery | Batched POST requests with retries. Failed batches are kept in a dead-letter queue, never dropped silently. |
Set up SIEM push
Create an HEC endpoint in your SIEM
In the Falcon console, open Next-Gen SIEM > Data onboarding and add an HEC / HTTP Event Connector data connector with a JSON parser. Generate its API key, then copy the API URL and the API key.
Open SIEM push in ANTS Platform
Go to Organization Settings > Integrations and open the SIEM Push card.
Enter the endpoint
| Field | Value |
|---|---|
| HEC URL | The collector URL from your SIEM |
| Token | The HEC token or API key. It is encrypted at rest and never shown again. |
| Event types | Any of AI events, Endpoint events, Alerts and Audit logs |
Save and check your SIEM
Save the settings. Events recorded from then on are pushed to your SIEM. Search for source="ants-platform" to see them arrive.
SIEM push covers every project in the organization. Each event names its project. Configuring it needs the Owner role or a custom role with the matching Integrations access. See Members & Roles.
Event types
| Event type | sourcetype | What is sent |
|---|---|---|
| AI events | ants:ai | Traces and observations from every project: name, agent, observation type, model, token counts, cost, latency, level, status message, environment and tags. Prompt and response text is not sent. |
| Endpoint events | ants:endpoint | Discover AI activity from the browser extension and the macOS and Windows agents: AI tool use, prompt submission events, files used in AI tools, command-line AI tool runs and AI network activity. The fields are those listed in Discover AI privacy. |
| Alerts | ants:alert | Guardrail violations, detected by Scheduled Detection or blocked by Real-time Enforcement, and Discover AI device alerts. The same content as a policy violation webhook. |
| Audit logs | ants:audit | Every audit log entry for the organization and its projects. |
Event schema
Each event is sent in the standard HEC envelope:
json
{
"time": 1759311000.123,
"host": "LT-0421",
"source": "ants-platform",
"sourcetype": "ants:endpoint",
"event": {
"schemaVersion": "1",
"id": "<event id>",
"category": "endpoint",
"kind": "prompt_submission",
"timestamp": "2026-10-01T09:30:00.123Z",
"organizationId": "<organization id>",
"projectId": "<project id>",
"user": {
"id": "<user id>",
"email": "jane.doe@example.com",
"userPrincipalName": "jane.doe@example.com",
"username": "jdoe"
},
"device": {
"id": "<device id>",
"hostname": "LT-0421",
"serialNumber": "C02XK0AAJG5H",
"falconAid": "<falcon agent id>"
},
"data": {
"tool": "ChatGPT",
"client": "browser-extension",
"model": "gpt-4o"
}
}
}
Envelope fields
| Field | Meaning |
|---|---|
time | When the event happened, in Unix seconds with milliseconds. |
host | The device hostname when the event comes from a device, otherwise your ANTS Platform host. |
source | Always ants-platform. |
sourcetype | ants:ai, ants:endpoint, ants:alert or ants:audit. |
Common event fields
| Field | Meaning |
|---|---|
schemaVersion | The schema version, currently 1. Fields can be added within a version; existing fields are not renamed or removed. |
id | Unique per event. Delivery is at least once, so deduplicate on it. |
category | ai, endpoint, alert or audit. |
kind | The record type within the category, listed below. |
timestamp | When the event happened, ISO 8601 in UTC. |
organizationId, projectId | Where the event belongs. projectId is null for organization-level audit entries. |
user | The person, with ANTS Platform user ID, email, user principal name and device username where known. null when the event has no user. |
device | The Discover AI device, with hostname, serial number and CrowdStrike Falcon agent ID where known. null when the event has no device. See CrowdStrike Falcon. |
data | The fields of the record itself. |
Kinds
category | kind | data |
|---|---|---|
ai | trace, observation | The trace or observation fields listed under Event types, with the trace ID and, for an observation, its ID and parent. |
endpoint | tool_activity, prompt_submission, file_use, cli_run, network_activity | The tool, the client that saw it and the fields listed in Discover AI privacy for that activity. |
alert | policy_violation, device_alert | The violation object of the policy violation webhook payload. |
audit | audit_log | The audit log entry, with the same fields as the S3 audit log stream. |
Any field whose value is not known is null.
Delivery
- Events are batched and sent as HEC
POSTrequests, within seconds of being recorded. - A batch that fails, for example because the SIEM is rate limiting or down, is retried with backoff.
- A batch that still fails after its retries is moved to a dead-letter queue instead of being dropped.
- Delivery is at least once. Deduplicate on
event.id. - Events are sent over HTTPS. Use an
https://HEC URL.
Scheduled exports to storage
SIEM push is the real-time path. Two scheduled exports also write files your SIEM can collect from storage:
| Export | What it writes | Where it is set |
|---|---|---|
| Audit log stream to S3 | Audit log entries as JSONL, hourly by default | Deployment settings |
| Blob storage export | Traces, observations and scores as JSON, CSV or JSONL, hourly, daily or weekly | Project Settings > Integrations > Blob Storage |