SIEM Integration
PurpletGo can forward security-relevant events to your SIEM in real time. Six target types are supported out of the box: Splunk (HTTP Event Collector), Datadog (Log Intake), Elasticsearch (single-document index API), Sumo Logic (HTTP Source), New Relic (Log API), and a generic HMAC-signed JSON webhook for anything else.
SIEM export is available on the Enterprise plan. Managing targets requires the Admin or Super Admin role.
Why forward events to a SIEM
Offboarding is a high-risk period for data exfiltration and access abuse. Forwarding PurpletGo events to your SIEM lets security teams:
- Correlate offboarding activity with access log anomalies in real time
- Maintain an independent copy of offboarding-related events for compliance audits
- Detect and alert on unusual patterns around access revocation and role changes
Configuring a SIEM target
Navigate to Settings → SIEM & Webhooks and click Add Target. Every target needs a name, a type, and an endpoint_url the target's own auth token is sent to - the URL can't point at a loopback or link-local address, since PurpletGo will be making outbound requests to it on every matching event.
Get your HEC endpoint and token
In Splunk, create a new HTTP Event Collector (HEC) input. Copy the HEC URL (e.g., https://your-splunk.example.com:8088/services/collector) and the generated token.
Enter details in PurpletGo
Select Splunk as the target type and paste the HEC URL as the endpoint and the token as the auth token. PurpletGo sends Authorization: Splunk <token> and wraps each event as { time, sourcetype: "purpletgo:security", source: "purpletgo", event } - there's no separate index or sourcetype field to configure.
Select event types
Choose which events this target should receive (see Events below). Leave the list empty to receive everything.
Save and test
Click Save, then use Send Test Event to fire a synthetic siem_test event at your endpoint and confirm it lands in Splunk.
Elasticsearch and Sumo Logic targets follow the same pattern as above - Elasticsearch expects your <index>/_doc URL and an ApiKey auth header; Sumo Logic just posts to your unique HTTP Source collector URL, which is itself the auth mechanism, so no token header is sent.
Delivery behavior
Each delivery is retried up to 3 times with exponential back-off (1s, 2s, 4s) before PurpletGo gives up and marks the target's last delivery as failed. Delivery is always best-effort - a SIEM outage never blocks or delays the underlying PurpletGo action. The target's last delivery time, status, and running delivery count are shown on the target list.
You can also run a Batch Export: pick a target and a date range, and PurpletGo replays every matching audit log entry from that window to the target sequentially.
Events
A target only receives the event types you select for it (or every event, if you leave the list empty). The events PurpletGo can forward are:
access_revokedstatus_changedoffboarding_createdoffboarding_deletedmember_removedmember_role_changedaudit_log_exportedchecklist_completed
access_revoked, status_changed, offboarding_created, offboarding_deleted, member_removed, member_role_changed, audit_log_exported, and checklist_completed are all treated as high severity; anything else (like the siem_test event fired by Send Test Event) is delivered as info.
Payload format
Every event carries the same base envelope, regardless of target type:
{
"event_type": "access_revoked",
"source": "purpletgo",
"org_id": "9f2b3c1a-...",
"timestamp": "2025-03-15T09:42:11.000Z",
"severity": "high"
}Additional fields specific to the event (employee, actor, etc.) are merged into this same object. How that object gets wrapped depends on the target type - Splunk gets it under an event key with HEC metadata, Datadog gets it JSON-stringified into a message field, and so on, as described above.