How-To: Export EZCA PKI Logs to a SIEM Solution

Why Should I Export My Cloud PKI Logs to a SIEM?

EZCA enables your security team to monitor critical user actions by pushing audit logs to your Security Information and Event Management (SIEM) solution. By exporting your Cloud PKI logs to your SIEM, you can:

• Centralize your security monitoring: By sending your Cloud PKI logs to your SIEM, you can centralize your security monitoring and have a single view of all your security events.
• Detect and respond to threats faster: By having your Cloud PKI logs in your SIEM, you can detect and respond to threats faster by correlating Cloud PKI events with other security events in your environment.
• Meet compliance requirements: Many compliance frameworks require organizations to monitor and log security events. By exporting your Cloud PKI logs to your SIEM, you can meet these requirements more easily.

Are Audit Logs Still Available in EZCA if I Don’t Export to my SIEM?

Yes. EZCA retains 365 days of audit logs in the EZCA portal. You can view these logs in the “Audit Logs” section of the EZCA portal. However, if you want to retain the logs for a longer period of time or want to have more advanced monitoring and alerting capabilities, we recommend exporting your logs to your SIEM.

Which SIEM Providers are Supported for Cloud PKI Log Export?

The following SIEM providers are currently supported:

• Azure Sentinel
• Splunk
• CrowdStrike Falcon LogScale
• CrowdStrike Falcon Next-Gen SIEM
• Datadog
• Huntress
• CloudWatch
• Kafka

If your SIEM provider is not currently supported email your Keytos contact and request a connector for that specific provider.

What Events are Sent to my SIEM from EZCA?

EZCA sends a variety of events to your SIEM to help you monitor your PKI activity. These events include:

CA Operation Events

Certificate Operation Events

How Do I Export Cloud PKI Audit Logs to my SIEM?