SIEM
PurpletGo + SIEM Export
30-day free trial - no credit card required
The SIEM Export integration is in beta. Confirm results in SIEM Export after using it, and contact us if anything looks wrong.
What it does
What PurpletGo does in SIEM Export
Send access revocation and offboarding stage events to Splunk, Datadog, Elasticsearch, Sumo Logic, New Relic, or any webhook.
- Sends an event in real time when access is revoked (with the result for each app) and when an offboarding changes stage.
- Retries failed deliveries and shows the last delivery status per destination.
- Sends a test event on demand, and exports up to 10,000 audit log entries for a date range.
- Signs generic webhook payloads with HMAC-SHA256 so you can verify they came from PurpletGo.
What you need
- A destination URL and the token or API key for your SIEM, or a signing secret for a generic webhook.
Plan
Enterprise
Compare plansSetup
Set up SIEM Export in PurpletGo
- 1
Open Settings > SIEM and add a destination: name, type, URL, token, and the events to send.
- 2
Send a test event to confirm delivery.
Good to know
- Delivery is retried three times; events are not queued beyond that.
Why this matters
Security teams that already watch Splunk or Datadog shouldn't have to separately check an offboarding tool for irregularities - the same audit events should show up where they're already looking.
SIEM Export FAQ
Common questions about the SIEM Export integration
What does PurpletGo do in SIEM Export?
Send access revocation and offboarding stage events to Splunk, Datadog, Elasticsearch, Sumo Logic, New Relic, or any webhook.
Why send offboarding events to your SIEM?
Security teams that already watch Splunk or Datadog shouldn't have to separately check an offboarding tool for irregularities - the same audit events should show up where they're already looking.
Which PurpletGo plan includes the SIEM Export integration?
Enterprise.
What do I need to connect SIEM Export to PurpletGo?
A destination URL and the token or API key for your SIEM, or a signing secret for a generic webhook.
Offboard with every system accounted for
Some integrations need the Team or Enterprise plan, shown above.
30-day free trial - no credit card required