Nile SIEM Integration Pull Mode

overview the siem events pull model is designed for customers whose siem platform polls nile apis from within their environment to retrieve siem events this workflow uses an api key generated in nile portal before the siem starts polling for events, you must create the api key and enable the siem events pull integration this model supports audit, user device events, alerts, and access engine rule logs prerequisites access to nile portal with permission to manage api keys and siem integration settings a siem platform that supports api based polling a dedicated api key created in nile portal at global settings > api key management > add key if the maximum number of api keys has been reached, revoke an unused key before creating a new one events are retained for 1 day, so configure the polling frequency accordingly api keys are valid for 365 days regenerate the key before it expires please note that api option is only available for administrator role setup steps go to global settings > api key management click the + icon to create a new key from the select workflow list, choose siem events pull click save to create the api key download the api key and store it securely confirm that the key appears in global settings > api key management go to global settings > integrations click + setup integration, then select siem events pull under siem enter "default" as the configuration name, then click next enable the required subscriptions and click save confirm that the integration appears in global settings > integrations steps to verify siem integration click the test icon to validate the event confirm that alerts > audit trail shows events such as api key creation, siem events pull integration creation, and the test connection event api call to retrieve siem events use this call for the initial request if you do not yet have an offset curl h "authorization bearer \<api token>" "https //\<nile portal url>/api/v1/siem/events?count=\<count value>" response {"events" \[{"time" 1783499803,"event" {"version" "1 0","id" "59be7c2b 8b7f 46e1 ad0f e574c070dc3f","clientmac" "94\ ea 32\ b1\ df 1d","clienteventseverity" "info","clienteventtimestamp" "2026 07 08t08 36 43+00 00","clienteventdescription" "client triggered disassociation","connectedssid" "nile dot1x","connectedbssid" "26 15 10 2a 02 4a","connectedport" "","connectedswitch" "","clientusername" "","clientlastknownipaddress" "not available","clienteventadditionaldetails" {"direction" "sta initiated"},"eventtype" "end user device events"}}],"count" 1,"lasteventoffset" "862613162606272857"} for subsequent requests, pass the offset (862613162606272857) of the last event returned by the previous response curl h "authorization bearer \<api token>" "https //\<nile portal url>/api/v1/siem/events?lasteventoffset=< offset value >\&count=\<count value>" count number of events to retrieve allowed values are 1 to 500 if omitted, the default value is 100 lasteventoffset offset of the last event returned in the previous response if omitted, the api returns the earliest available pull events note store the latest returned offset after each poll and use it in the next request to continue retrieving new events without re reading older events this siem test event was generated by clicking the test icon {"time" 1781688210, "event" { "test message" true, "eventtype" "test"}}