> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# SIEM Syslog

SIEM integration with Identity as a Service allows audit logs to be sent to syslog through an Enterprise Service Gateway. The Syslog SIEM application downloads audit logs from Identity as a Service into your Enterprise Service Gateway and publishes them to your on-premise SIEM syslog server. For more information on audit logs, see [View and export audit logs](/docs/reports-and-audits/view-and-export-audit-logs.md).

## Add SIEM syslog to Identity as a Service

1. In Identity as a Service, click Menu icon **>** **Security > Applications**. The **Applications List** page appears.

2. Click **Add**. The **Select an Application Template** page appears.

3. Do one of the following:

   - Select **Identity as a Service Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

4. Click **SIEM Syslog**. The **Add SIEM Syslog** page appears.

5. In the **Application Name** field, type a name for your application.

6. Optional. In the **Application Description** **field, type a** description for your application.

7. Optional. Add a custom application logo.Optional. Add a custom application logo.

   1. Click Circle Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears.
   2. Click Arrow Up From Line icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image.
   4. If required, resize your image.
   5. Click **OK**.

8. Click **Next**. The **Add SIEM Syslog** page appears.

9. In the **Connection Settings**, do the following:

   1. Enter the **Syslog Host**. This is the destination server for the syslogs.

      > Example: `localhost`

   2. Select the **Transport protocol** from the drop-down list.

   3. Enter the **Syslog Port**. The default is 514.

   4. Select the **SIEM Agent** from the drop-down list. This is the gateway that reroutes the logs to the syslog server.

10. In **Log Settings**, do the following:

    1. Enter the **Log Interval (in seconds)** to specify how frequently the SIEM agent fetches the audits from Identity as a Service.
    2. Select the **Log Event Type** from the drop-down list to set the type of audit logs sent to the syslog server (Authentication, Management, or All).
    3. Select the **Log Event Outcome** from the drop-down list to set the type of audit log events sent to the syslog server (Success, Fail, All).
    4. Select the **Log Start Time** to set how far back in history to log existing audits. Options include:
       - None: Start with current logs.
       - Past Day: Start with audits that are up to a day old.
       - Past Week: Start with audits that are up to a week old.

info
This setting applies only when a new SIEM syslog application starts logging for the first time. After that, it logs any audits added since the last time it logged them. If you edit your SIEM syslog application at a later time, a **Last Audit Logged Time** field replaces this setting.

11. Click **Submit**.