Connect HEC Log Exporter

This article outlines the steps required to ship Cloud Control Center logs to any SIEM, XDR, or log management platform that supports the HEC (HTTP Event Collector) protocol.

The HEC Log Exporter connector enables exporting Elisity platform logs to any platform that accepts logs via a standard HEC HTTP collector endpoint — including Palo Alto Networks Cortex XSIAM, Datadog, Elastic, and Sumo Logic. Exportable log categories include policy enforcement logs, identity and classification events, system events, audit logs, and Virtual Edge Node (VEN) events.

Unlike the existing Splunk connector, which uses Splunk-specific semantics such as the Authorization: Splunk <token> header format, this connector is protocol-generic. It authenticates with a token and a configurable token prefix (Bearer by default), so it can target any compliant HEC endpoint.

Prerequisites

• Minimum Cloud Control Center version 26.4.0
• An HEC-compatible HTTP log collector endpoint on the target platform (the full HTTPS URL)
• An authentication token or API key generated on the target platform
• Inbound firewall rules/NAT to allow Cloud Control Center to reach the log collector endpoint over HTTPS (TLS 1.2 or higher)

How It Works

Once configured, Cloud Control Center sends each event in the supported log categories to the target endpoint as a separate HTTPS POST request with a JSON body. The body wraps the event in a data field, along with a millisecond-precision collector_ms timestamp. The contents of data depend on the connector's Export Format (see Export Formats below). With the default JSON format, the body looks like this:

{
  "data": {
    "id": "<event-id>",
    "level": "INFO",
    "type": "...",
    "category": "...",
    "action": "...",
    "username": "admin@example.com",
    "roles": "...",
    "context": { ... },
    "time": "2026-10-08T14:23:45.123Z",
    "octime": "2026-10-08T14:23:45.000Z"
  },
  "collector_ms": 1791469425123
}

Alert and activity log events also include origin, siteLabelId, and activityId. The JSON format is directly compatible with the Cortex XSIAM HTTP Log Collector, and most HEC-compatible platforms (including those that auto-detect JSON) can parse it without additional configuration. If delivery to the target platform fails (a non-2xx response, a connection failure, or no response within 10 seconds), Cloud Control Center keeps the event and retries it on the next delivery cycle.

Export Formats

Each connector sends events in the format selected in its Export Format field. Every format uses the same HTTPS transport and JSON request body; only the value of data changes.

CEF and LEEF map Elisity fields as follows:

Severity follows the event level: TRACE 0 (1 in LEEF), DEBUG 2, INFO 3, WARN 5, ERROR 8, FATAL 10, and 3 when no level is set. Without a category, the CEF Signature ID uses the type and the LEEF Event ID uses the action. Without an action, the CEF Name uses the category. Any other missing header value is written as unknown. CEF and LEEF events longer than 8 KB are truncated and end with [...TRUNCATED].

Target Platform Instructions (Example: Cortex XSIAM)

The exact steps to create an HEC HTTP collector vary by platform. As an example, for Palo Alto Networks Cortex XSIAM:

1. In Cortex XSIAM, navigate to Settings > Data Sources and add a Custom - HTTP based Collector integration.

2. Generate the collector and copy the API URL (for example, https://api-{tenant}.xdr.us.paloaltonetworks.com/logs/v1/event) and the token.

3. Refer to the Cortex XSIAM documentation for full details.

For other platforms (Datadog, Elastic, Sumo Logic, and others), consult the vendor's documentation for creating an HTTP/HEC log ingestion endpoint and generating an access token. In every case, you need two values for the Cloud Control Center configuration: the endpoint URL and the authentication token.

Elisity Cloud Control Center Instructions

1. Log into Elisity Cloud Control Center, navigate to Monitoring > External Monitors, and select + Add External Monitor.

2. In the Add External Monitor panel, search for HEC, then select Configure on the HEC Log Exporter tile.

3. Complete the configuration fields:

4. Select Submit. The connector is now listed on the External Monitors page.

5. Verify that Cloud Control Center logs appear on the target platform within a few seconds.

Monitoring the Connector

Once configured, the connector is listed on the Monitoring > External Monitors page with its type, name, and creation and modification details. Each row provides an Actions menu for managing the monitor.

In the Add External Monitor panel, the HEC Log Exporter tile shows an Active state and the configuration timestamp, and Configure is replaced by Connector Already Exists. Active indicates that log forwarding is enabled.

The connector can be disabled and re-enabled without deleting its configuration, and all settings, including the Export Format, can be edited after the initial setup. For more information about the Monitoring area, see Monitoring.

Troubleshooting

• Connector reports a 401/403 error — The authentication token is invalid, expired, or sent in the wrong format. Verify the Token value and confirm the Token Prefix matches what the platform expects (most platforms use Bearer).

• Connector reports a TLS/certificate error — The target endpoint's certificate could not be validated. Confirm the endpoint presents a complete, trusted certificate chain that Cloud Control Center can validate.

• Connection times out — Cloud Control Center cannot reach the endpoint. Verify the URL and confirm firewall/NAT rules allow outbound HTTPS from Cloud Control Center to the collector endpoint.

• Events are not appearing on the target platform — On the Monitoring > External Monitors page, confirm the connector is present and enabled and that its URL and Token values are correct, then verify any ingestion filters or parsing rules on the receiving platform.

• Events arrive but are not parsed into fields — Confirm that the connector's Export Format matches the parser on the receiving platform (for example, a CEF parser for CEF), and that the platform extracts the event from the data field.