Cdata Audit Event Forwarding

specification: API Commons Webhooks
specificationVersion: '0.1'
provider: CData
providerId: cdata
generated: '2026-09-05'
method: searched
source: https://docs.cloud.cdata.com/en/Settings/Siem-Endpoints.md
asyncapi_published: false
asyncapi_note: >-
  CData publishes no AsyncAPI document. Probed https://docs.cloud.cdata.com/asyncapi.yaml
  (404) and https://docs.cloud.cdata.com/en/API/AsyncAPI.yaml (404);
  https://cloud.cdata.com/asyncapi.json returns HTTP 200 but with the Connect AI SPA shell
  (text/html), which is not a document. Recorded as absent, not fabricated.
scope_caveat: >-
  This is NOT a general-purpose webhook catalogue. CData does not let a customer subscribe an
  arbitrary URL to arbitrary product events. What it publishes is one outbound event-delivery
  surface with a fixed purpose — forwarding audit log events to a SIEM — with two supported
  destination types. It is recorded here because it is a real, documented, first-party HTTP
  event push with a delivery contract, retry semantics and a declared payload schema, and
  because it is the only asynchronous surface CData publishes. Read the scope before treating
  it as a webhook product.
surface:
  name: SIEM Endpoints
  availability: Business tier, Connect AI only (explicitly not available for Connect AI Embed)
  configuration: Settings > SIEM Endpoints in the Connect AI UI
  api_managed: false
  api_note: >-
    Endpoints are configured in the UI. No Management API operation creates, lists or deletes
    a SIEM endpoint — this surface is not itself programmable.
  direction: outbound (CData pushes to a customer-configured collector)
  transport: HTTPS POST
delivery:
  batching:
    batch_size_events: configurable
    batch_size_time_seconds: configurable
    note: A batch is sent when either the event count or the time interval is reached.
  compression: 'GZIP, toggleable (Datadog destination)'
  tls_verification: >-
    CData verifies the TLS certificate the collector presents on every request. The
    certificate must be issued by a public certificate authority and match the hostname.
    Self-signed and internal-CA certificates are refused.
  validation: >-
    The address is validated on every save (HTTPS, publicly reachable, publicly trusted
    certificate). Token validation happens when the endpoint is enabled: enabling sends a
    single test event and refuses to save if the collector rejects it, naming the address
    that failed. With multiple indexer addresses, testing stops at the first failure.
  failure_handling:
    status_values: [Active, Failed, Pushing]
    delayed_event_alert_threshold: >-
      configurable — after N delayed events, CData emails an alert to a named recipient.
    note: >-
      No retry policy, redelivery window or dead-letter behaviour is published. A consumer
      learns about failure from the endpoint status and the delay-threshold email, not from
      a documented redelivery contract.
destinations:
- name: Datadog Logs API
  format: Datadog Logs
  config: [Region, DD-API-KEY, Endpoint URL (autogenerated from region), Service Tag]
- name: Splunk HTTP Event Collector (HEC)
  format: OCSF (Open Cybersecurity Schema Framework)
  sourcetype: 'ocsf:cdata:connect'
  config: [HEC Endpoint URL, HEC Token, Source, Sourcetype (read-only)]
  fan_out: up to ten indexer addresses, comma-separated
  constraint: >-
    Splunk indexer acknowledgement must be DISABLED. CData does not send a channel
    identifier, so with acknowledgement on, none of the events are indexed. CData returns an
    error naming the setting if it is enabled at save time. The acknowledgement setting
    cannot be changed after a token is created — a new token is required.
  standard: >-
    OCSF is a domain standard for security event schemas; a SIEM that already parses OCSF
    ingests these events with no bespoke mapping. Recorded in
    conformance/cdata-conformance.yml.
events:
  scope_options: [All Events]
  coming_soon: ['specific event classes, e.g. Control Plane events']
  documented_categories:
  - user logins
  - query activity
  - connection changes
  note: >-
    CData does not publish a per-event-type catalogue with names and payload schemas — only
    these three categories in prose plus the OCSF format declaration for the Splunk
    destination. There is no event reference page to enumerate, so none is invented here.
related:
  audit_log_api:
    note: >-
      The same audit data is available by pull rather than push, through the REST API's
      POST /log/audit/list (listAuditLog) and POST /log/query/list (listQueryLog), which ARE
      described by openapi/cdata-rest-api-openapi.yml. Most consumers should read those
      rather than stand up a SIEM endpoint.
    operations: [listAuditLog, listQueryLog, getQueryLog]
maintainers:
- FN: Kin Lane
  email: info@apievangelist.com