Generic HTTP Connector

The Generic HTTP Connector lets you export Nile SIEM events to an HTTP or HTTPS endpoint for ingestion by your security or analytics platform.

Use the Generic HTTP Connector when you want Nile to send security event data to a destination that can receive JSON payloads over HTTP or HTTPS. The connector supports flexible delivery options, including multiple authentication methods, selectable payload formats, and configurable request behavior.

You can create and manage a Generic HTTP Connector in Nile Portal by entering the endpoint details, selecting the authentication method, and choosing the event categories to export.

Before you begin, make sure you have the following:

The Generic HTTP Connector currently supports the following options:

The connector supports two JSON payload formats:

In this format, the request body contains newline-delimited JSON, where each line is a valid JSON object. This format is useful for destinations that expect streaming-style event ingestion similar to HTTP event collectors.

In this format, the request body is a standard JSON array containing multiple event objects.

When certificate validation is enabled, the connector validates both the server certificate trust chain and the certificate hostname. The certificate's common name must match the hostname in the configured URL, and the certificate must be trusted by the connection.

If certificate validation is disabled, hostname validation and trust validation are both skipped.

If your destination uses a private CA or self-signed certificate, Nile can support it in one of two ways:

For production deployments, using certificate validation with a trusted public CA or an uploaded custom CA is the preferred approach.

Follow these steps to create a Generic HTTP Connector in the Nile Portal.

Sign in to Nile Portal using an administrator account.

From the main navigation, go to Global Settings and then open the Integrations subtab.

Click the ”+ SETUP INTEGRATION” icon to open the list of available integrations.

From the available integration types, select Generic HTTP Connector.

In the connector configuration window, provide a Name and Endpoint URL for your HTTP or HTTPS receiver.

Select the required request method and payload format for your destination. Use POST or PUT as required by your receiver, and choose either event-per-line JSON or JSON array format.

Choose the authentication method required by your receiver:

If you select Token-based authentication, enter the header name and token value.

If you select Basic authentication, enter the username and password.

If you select Mutual TLS, upload the client certificate in .P12 or .PFX format and enter the keystore password. Both fields are required.

If your destination uses HTTPS, choose whether certificate validation should remain enabled. If the server certificate is signed by a private or self-signed CA, upload the CA certificate so Nile can trust the connection.

If your destination platform requires extra headers, add them in the custom headers section.

Once the customer headers are added, click Next to enable the Subscriptions

Choose the event categories you want Nile to export through this connector. The subscription options include Audit, User Device Events, and Alerts.

Review the configuration and click Save to create the Generic HTTP Connector.

After saving the connector, verify that the integration shows a healthy status and confirm that events are arriving at your destination endpoint.

After configuration is complete, confirm that your destination receives Nile events in the expected format and that authentication and TLS settings behave as intended.

If your platform supports request inspection or event search, verify that events are arriving under the expected source and topic naming conventions for your environment.

If events are not arriving as expected, review the following: