Nile SIEM Event Schema

8 min

Introduction

The Security Information and Event Management (SIEM) event schema defines the standardized structure and format of event data sent to SIEM platforms. It plays a critical role in enabling effective security monitoring, threat detection, and compliance auditing. By enforcing a consistent structure across various event types, the schema ensures accurate representation and seamless integration with security analytics tools.

Supported Event Categories

The Nile SIEM event schema currently supports the following categories:

Alerts: Real-time notifications automatically generated by Nile in response to predefined security conditions or anomalies.

Audit Events: Comprehensive logs of user and system activity, designed to support audit trails, compliance requirements, and forensic investigations.

End-User Device Events: Telemetry and behavioral data from user devices that help monitor endpoint activity and identify potential security risks.

Event Format and Integration

Nile uses a push-based integration approach to deliver event data to SIEM systems. This is implemented using the industry-standard HTTP Event Collector (HEC) protocol with events formatted in JSON. This ensures that event data is both structured and easily consumable by modern SIEM solutions.

Important Notes:

Syslog-based integrations are not supported.

All events are pre-processed, well-defined, and delivered exclusively in structured JSON format to maximize compatibility and simplify parsing.

Please refer Version 1 - SIEM Event Schema for the latest JSON schema.

Example of a Complete Payload

Below is a detailed overview of the SIEM schema based on various event types:

{
  "time": 1739963820,
  "sourcetype": "_json",
  "event": {
    "version": "1.0",
    "id": "076096cf-93d8-41c7-92a1-0d7d0a4bda84",
    "auditTime": "2025-04-09T04:53:59+00:00",
    "user": "[email protected]",
    "sourceIP": "14.99.4.110",
    "agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36",
    "auditDescription": "Created SSID 'PIPELINE_SSID_BUILDING_PSK'",
    "entity": "SSID",
    "action": "Create",
    "additionalDetails": {
      "newValue": {
        "name": "PIPELINE_SSID_BUILDING_PSK",
        "ssid": {
          "security": "WPA2 Personal",
          "segmentNames": [
            "PL_SEGMENT-BUILDING-WO-RADIUS-CLHIT"
          ]
        },
        "tags": [
          "all"
        ]
      }
    },
    "eventType": "audit_trail"
  }
}

time: Epoch time of the event.

sourcetype: Indicates the payload format, which is always JSON.

event: Actual SIEM Event.

eventType: Type of event. Supported values:

"audit_trail"

"nile_alerts"

"end_user_device_events"

"test"

Payload Details for Different Event Types

Audit Events

Example of Audit Event Payload (eventType=="audit_trail") :

{
  "version": "1.0",
  "id": "076096cf-93d8-41c7-92a1-0d7d0a4bda84",
  "auditTime": "2025-04-09T04:53:59+00:00",
  "user": "[email protected]",
  "sourceIP": "14.99.4.110",
  "agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36",
  "auditDescription": "Created SSID 'PIPELINE_SSID_BUILDING_PSK'",
  "entity": "SSID",
  "action": "Create",
  "additionalDetails": {
    "newValue": {
      "name": "PIPELINE_SSID_BUILDING_PSK",
      "ssid": {
        "security": "WPA2 Personal",
        "segmentNames": [
          "PL_SEGMENT-BUILDING-WO-RADIUS-CLHIT"
        ]
      },
      "tags": [
        "all"
      ]
    }
  },
  "eventType": "audit_trail"
}

version: The version of the audit event schema.

id: A UUID representing the event.

action: Indicates the type of action performed, such as “Create,” “Update,” “Test,” “Login,” “Logout,” etc.

entity: Specifies the type of entity where the action was performed, such as “User,” “Segment,” “DHCP,” “RADIUS,” “MAB,” etc.

additionalDetails: Contains information about the change. It includes two fields: “newValue” and “oldValue.” For an update event, both values are populated; for a create event, only the new value is provided. The content of these fields depends on the entity type. Sensitive information like passwords or keys is excluded.

agent: The user-agent part of the HTTP request.

auditDescription: A human-readable description of the event.

errorMessage: If the operation fails, this contains a descriptive error message; otherwise, it is null.

sourceIP: The IP address from which the action was performed.

auditTime: The timestamp of the event in ISO-8601 format (yyyy-MM-dd'T'HH:mm:ssxxx).

user: The user who performed the action.

End User Events

Example of End User Event Payload (eventType=="end_user_device_events") :

{
  "version": "1.0",
  "id": "8e2fc3b9-dbad-46f2-9a69-3fea72a7108d",
  "clientMac": "58:47:ca:73:cb:e6",
  "clientEventSeverity": "INFO",
  "clientEventTimestamp": "2025-04-30T09:33:52+00:00",
  "clientEventDescription": "DHCP Renew Request Success",
  "connectedSsid": "",
  "connectedBssid": "",
  "connectedPort": "0/11",
  "connectedSwitch": "0b:15:10:20:05:49",
  "clientUsername": "CLHIT_MINIS1",
  "clientLastKnownIpAddress": "10.151.82.63",
  "clientEventAdditionalDetails": {
    "server_ip": "10.132.14.2",
    "sourceSerialNum": "E00A00064648",
    "ip_address": "10.151.82.63"
  },
  "eventType": "end_user_device_events"
}

id : User device event id. This will be uniquely generated for every user device event.

clientMac: MAC address of the end-user device.

clientEventSeverity: Severity of the event. Possible values:

INFO: Indicates success or informational events.

CRITICAL: Indicates failure scenarios.

clientEventTimestamp: The timestamp of the event represented in ISO-8601 format (yyyy-MM-dd'T'HH:mm:ssxxx).

clientEventDescription: Describes various client events related to:

Authentication events for wireless (Enterprise, PSK, UPSK, Open, SSO, Captive Portal, Guest, etc.) and wired clients (MAB, Radius Mac Auth, Dot1x).

Examples: Authorized event, Disassociation event, Authentication failed event.

DHCP and DNS success and failure events for wireless and wired clients.

RADIUS errors, including configuration errors, timeouts, null negotiation segments, etc., for wireless and wired clients.

Client sticky errors and successes.

Static IP, IP conflict errors, and success events (functionality yet to be enabled in production).

SSO and Guest transition events.

Credential-related events.

Example: "clientEventDescription": "DHCP Renew Request Success"

connectedSsid: SSID name.

For wireless clients, ssid represents the actual SSID to which the client is connected.

Example: "ssid": "Nile"

connectedBssid: BSSID of the SSID.

For wireless clients, it represents the BSSID to which the client is connected.

Example: "bssid": "26:15:10:2b:01:c2"

For wired clients, it represents the switch MAC address.

Example: "bssid": "24:15:10:20:c9:12"

connectedPort : Port details to which wired client is connected. Example port 0/40

connectedSwitch : Switch serial number or mac address to which wired client is connected.

clientUsername : Username of client. Example: [email protected]

clientLastKnownIpAddress : Last known IP address of client. This will be current IP address for online client and last known IP address for offline or error clients.

clientEventAdditionalDetails: A JSON string containing formatted additional information, which can be NULL. It may include server IP and serial numbers for DHCP, DNS servers, etc. In some events, it may also contain the client's IP address.

Example: "additionalDetails": "{\"server_ip\":\"10.4.5.1\",\"sourceSerialNum\":\"A00A00076253\",\"ip_address\":\"10.4.5.38\"}"

Alerts

Example of Alerts Payload (eventType=="nile_alerts") :

{
  "version": "1.0",
  "id": "ee0452ca-fd53-4034-a3cf-eb0a13287567",
  "alertSubscriptionCategory": "Security Alerts",
  "alertType": "Security",
  "alertStatus": "Resolved",
  "alertSubject": "Nile Alert Resolved [Security]",
  "alertSummary": "Impersonation Attack: Honeypot AP (BSSID : 26:15:10:21:13:dc) spoofing a valid Nile AP SSID PIPELINE_SSID_BUILDING_PSK has been detected in the air.",
  "impact": "This AP is not authorized to advertise network WiFi service with the same SSID as Nile Service. User devices may accidentally connect to the impersonating AP that is attempting a man-in-the-middle intrusion. This is a security issue.",
  "customer": "BLR_R2I_HW-CL-HIT-HW",
  "startTime": "2025-04-09T05:06:11+00:00",
  "duration": "12 minutes",
  "site": "BLR-R2I-HW-CL-HIT-S2",
  "building": "BLR-R2I-HW-CL-HIT-S2-B1",
  "floor": "CLHIT-TESTHW-S2-B1-F1",
  "additionalInformation": "https://docs.nilesecure.com/nile-security-alerts",
  "eventType": "nile_alerts"
}

version: The version of the alert event schema.

id: UUID of the alert. Events will be sent when an alert is created and resolved. This ID can be used to correlate the information.

alertSubscriptionCategory: These are the Nile Alerts categories, for example:

"Nile Service Alerts"

"Infrastructure Alerts"

"Application Alerts"

"Security Alerts"

alertType: This indicates the type of alerts, for example:

“AQI”

"High Temperature"

"Link"

"PoE"

alertStatus: Status of the alert. Valid values are "Created" and "Resolved".

alertSubject: Describes the alert.

alertSummary: Textual summary of the alert.

impact: Describes the impact of the alert.

customer: Customer name.

site / building / floor: Names of the site, building, and floor respectively.

duration: The duration of the alert, presented as descriptive text such as "10 minutes" or "1 hour 12 minutes" as seen in the Nile Portal.

startTime: The start time of the alert in ISO-8601 format (yyyy-MM-dd'T'HH:mm:ssxxx).

NOTE : This same schema is used for Alerts over Webhook Integration.