Guide to integrating Push with your SIEM / SOAR

You can send Push telemetry to external systems to create custom detections, correlations, and automations using a SIEM, SOAR, or other workflow tool.

You can use this data to:

• Investigate phishing and other security incidents.

• Harden identities and reduce account compromise, such as alerting you when passwords are identified in public data breaches or when employees are using an unapproved app or when an SSO app is accessed via local account.

• Monitor for suspicious activity or high-risk changes, such as checking for MFA method changes, or flagging when employees reuse corporate passwords.

• Automate a workflow showing you all the accounts and apps used by an offboarded employee, and their account login methods.

• Automate a workflow to revoke app licenses after a period of inactivity, saving money.

• Force-reset an IdP password if Push finds a compromised password on an employee account.

Note: Push already provides readymade detections on the Detections page and security controls on the Controls page in the Push admin console. This section of documentation focuses on how to extend these capabilities using external integrations.

Using the Events page

The Events page in the admin console provides a rolling 30-day snapshot of all the events generated in your environment. You can use the Events page to help you understand event attributes and gauge event volume before sending events to a third-party tool.

Use the filtering options to view events by type.

Platform-specific integrations

Push provides the following platform-specific integrations:

• Microsoft Sentinel SIEM

• Panther SIEM

• Datadog SIEM

• Cribl Cloud

• Splunk Cloud

• SentinelOne

• Tines

Refer to the related help articles for setup steps.

Generic integrations

You can also send Push events to your SIEM or SOAR by setting up a webhook receiver log type that will provide you with a webhook destination URL.

Note: This method works only if your SIEM supports ingestion where the authentication method is “none.”

1. In the Push admin console, select Settings in the left navigation.

2. Go to the Webhooks tab and click the +Webhook button.

3. In the URL field, input the webhook destination URL provided by your SIEM, then click Generate Webhook in Push. Optionally, configure custom headers and select which events to send.

4. Important! Save your webhook secret key in a safe place to refer to later if needed.

5. Once you select Generate Webhook, Push will provide you with a webhook secret key. You can use it to perform signature verification in webhook events.

You can view the webhook events generated by Push in our webhooks documentation.