Connect HEC Log Exporter

This article outlines the steps required to ship Cloud Control Center logs to any SIEM, XDR, or log management platform that supports the HEC (HTTP Event Collector) protocol.

The HEC Log Exporter connector enables exporting Elisity platform logs to any platform that accepts logs via a standard HEC HTTP collector endpoint — including Palo Alto Networks Cortex XSIAM, Datadog, Elastic, and Sumo Logic. Exportable log categories include policy enforcement logs, identity and classification events, system events, audit logs, and Virtual Edge Node (VEN) events.

Unlike the existing Splunk connector, which uses Splunk-specific semantics such as the Authorization: Splunk <token> header format, this connector is protocol-generic. It authenticates with a token and a configurable token prefix (Bearer by default), so it can target any compliant HEC endpoint.

Prerequisites

• Minimum Cloud Control Center version 26.4.0
• An HEC-compatible HTTP log collector endpoint on the target platform (the full HTTPS URL)
• An authentication token or API key generated on the target platform
• Inbound firewall rules/NAT to allow Cloud Control Center to reach the log collector endpoint over HTTPS (TLS 1.2 or higher)

How It Works

Once configured, Cloud Control Center sends the supported log categories to the target endpoint as HTTPS POST requests with a JSON payload. Events are batched for efficiency and flushed when either the configured batch size or the flush interval is reached, whichever comes first. Each event is wrapped in a data object containing the native Elisity event, along with a millisecond-precision collector_ms timestamp:

{
  "data": {
    "event_type": "policy_enforcement",
    "timestamp": "2026-02-23T10:30:00Z",
    "source": "elisity-ccc",
    "payload": { ... }
  },
  "collector_ms": 1740312600000
}

This format is directly compatible with the Cortex XSIAM HTTP Log Collector, and most HEC-compatible platforms (including those that auto-detect JSON) can parse it without additional configuration. If delivery to the target platform fails, Cloud Control Center retries with exponential backoff and honors HTTP 429 rate-limit responses, including the Retry-After header when provided.

Target Platform Instructions (Example: Cortex XSIAM)

The exact steps to create an HEC HTTP collector vary by platform. As an example, for Palo Alto Networks Cortex XSIAM:

1. In Cortex XSIAM, navigate to Settings > Data Sources and add a Custom - HTTP based Collector integration.

2. Generate the collector and copy the API URL (for example, https://api-{tenant}.xdr.us.paloaltonetworks.com/logs/v1/event) and the token.

3. Refer to the Cortex XSIAM documentation for full details.

For other platforms (Datadog, Elastic, Sumo Logic, and others), consult the vendor's documentation for creating an HTTP/HEC log ingestion endpoint and generating an access token. In every case, you need two values for the Cloud Control Center configuration: the endpoint URL and the authentication token.

Elisity Cloud Control Center Instructions

1. Log into Elisity Cloud Control Center, navigate to Monitoring > External Monitors, and select + Add External Monitor.

2. In the Add External Monitor panel, search for HEC, then select Configure on the HEC Log Exporter tile.

3. Complete the configuration fields:

4. Select Submit. The connector is now listed on the External Monitors page.

5. Verify that Cloud Control Center logs appear on the target platform within a few seconds.

Monitoring the Connector

Once configured, the connector is listed on the Monitoring > External Monitors page with its type, name, and creation and modification details. Each row provides an Actions menu for managing the monitor.

In the Add External Monitor panel, the HEC Log Exporter tile shows an Active state and the configuration timestamp, and Configure is replaced by Connector Already Exists. Active indicates that log forwarding is enabled.

The connector can be disabled and re-enabled without deleting its configuration, and all settings can be edited after the initial setup. For more information about the Monitoring area, see Monitoring.

Troubleshooting

• Connector reports a 401/403 error — The authentication token is invalid, expired, or sent in the wrong format. Verify the Token value and confirm the Token Prefix matches what the platform expects (most platforms use Bearer).

• Connector reports a TLS/certificate error — The target endpoint's certificate could not be validated. Confirm the endpoint presents a complete, trusted certificate chain that Cloud Control Center can validate.

• Connection times out — Cloud Control Center cannot reach the endpoint. Verify the URL and confirm firewall/NAT rules allow outbound HTTPS from Cloud Control Center to the collector endpoint.

• Events are not appearing on the target platform — On the Monitoring > External Monitors page, confirm the connector is present and enabled and that its URL and Token values are correct, then verify any ingestion filters or parsing rules on the receiving platform.