> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/miscellaneous-integrations/siem-connectors/siem-field-reference.md).

# SIEM Field Reference

This page describes the fields included in each Aikido issue and each activity log entry when they're sent to your connected SIEM.

For how to connect a specific SIEM, see [SIEM Connectors](/miscellaneous-integrations/siem-connectors.md).

### Payload format

Each sync sends a JSON array, with one object per issue that matches your [issue input settings](/miscellaneous-integrations/siem-connectors.md). If you enable activity logs, each sync also sends one object per new activity log entry. The fields are the same across every SIEM connector.

Activity log entries have `data_type` set to `activity_log`. Issue objects don't have a `data_type` field, so use it to tell the two apart in your SIEM. For the activity log fields, see [Activity log fields](#activity-log-fields).

### Core fields

| Field                  | Type           | Description                                                                                                                                                                                                         |
| ---------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `id`                   | integer        | The individual issue's ID.                                                                                                                                                                                          |
| `group_id`             | integer        | The ID of the issue group this issue belongs to. Aikido groups related occurrences of the same underlying issue together.                                                                                           |
| `attack_surface`       | string         | One of `frontend`, `backend`, `docker_container`, `cloud`, `cloud_instance`.                                                                                                                                        |
| `status`               | string         | One of `open`, `ignored`, `snoozed`, `closed`.                                                                                                                                                                      |
| `severity`             | string         | One of `critical`, `high`, `medium`, `low`.                                                                                                                                                                         |
| `severity_score`       | integer        | Aikido's priority score for the issue, from 1 to 100.                                                                                                                                                               |
| `type`                 | string         | One of `open_source`, `leaked_secret`, `cloud`, `cloud_instance`, `docker_container`, `iac`, `sast`, `surface_monitoring`, `malware`, `eol`, `scm_security`, `ai_pentest`, `ai_code_analysis`, `mobile`, `license`. |
| `rule`                 | string or null | The rule title, for SAST, IaC, cloud, and surface monitoring issues. Null for other types.                                                                                                                          |
| `programming_language` | string or null | Detected from the affected file path, for example `JS`, `PHP`, `PY`, `Java`.                                                                                                                                        |
| `how_to_fix`           | string or null | Aikido's remediation guidance for the issue, if available.                                                                                                                                                          |

### Vulnerability fields

| Field              | Type           | Description                                                                                         |
| ------------------ | -------------- | --------------------------------------------------------------------------------------------------- |
| `cve_id`           | string or null | The CVE ID, or an internal Aikido CVE ID (for example `AIKIDO-2020-123`) when no public CVE exists. |
| `cve_id_alias`     | string or null | The related public CVE, when `cve_id` is an internal Aikido CVE ID.                                 |
| `affected_package` | string or null | The affected package name, if any.                                                                  |
| `affected_file`    | string or null | The affected file or target path, if any.                                                           |

### Location fields

Only the field group matching where the issue was found is populated; the rest are null.

| Field                                        | Type                            | Description                                     |
| -------------------------------------------- | ------------------------------- | ----------------------------------------------- |
| `code_repo_id`, `code_repo_name`             | integer or null, string or null | The code repository, for source-code issues.    |
| `container_repo_id`, `container_repo_name`   | integer or null, string or null | The container repository, for container issues. |
| `cloud_id`, `cloud_name`                     | integer or null, string or null | The cloud account, for cloud issues.            |
| `domain_id`, `domain_name`                   | integer or null, string or null | The domain, for surface monitoring issues.      |
| `virtual_machine_id`, `virtual_machine_name` | integer or null, string or null | The VM, for VM issues.                          |

### Status and timing fields

| Field               | Type                   | Description                                                                                                                                                                |
| ------------------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `first_detected_at` | unix timestamp         | When the issue was first created.                                                                                                                                          |
| `ignored_at`        | unix timestamp or null | When the issue was ignored, if it has been.                                                                                                                                |
| `closed_at`         | unix timestamp or null | When the issue was closed, if it has been.                                                                                                                                 |
| `sla_remediate_by`  | unix timestamp or null | The SLA deadline for remediation, if one applies.                                                                                                                          |
| `snooze_until`      | unix timestamp or null | When a snooze expires, if the issue is snoozed.                                                                                                                            |
| `snooze_reason`     | string                 | Why the issue is snoozed. Empty string if it isn't.                                                                                                                        |
| `ignore_reasons`    | array                  | Why the issue is ignored. Empty array if it isn't. Each entry has a `kind` (`manual_ignore`, `auto_ignore`, `rule_ignore`, or `api_ignore`) and a human-readable `reason`. |

### Issue type metadata

`issue_type_metadata` is an object that's only included for some issue types, with at most one of the following keys set, matching the issue's `type`:

| Key                  | Fields                                                                                               |
| -------------------- | ---------------------------------------------------------------------------------------------------- |
| `sast`               | `start_line`, `end_line`                                                                             |
| `cloud`              | `resource_id`, `resource_name`, `resource_kind`                                                      |
| `surface_monitoring` | `cve_id`, `package_name`, `package_version`, `evidence`, `evidence_description`, `domain_target_url` |
| `open_source`        | `installed_version`, `patched_versions` (array)                                                      |
| `eol`                | `eol_since` (unix timestamp or null), `affected_version`                                             |
| `leaked_secret`      | `commit`, `line`                                                                                     |

### Example

```json
[
  {
    "id": 1,
    "group_id": 1,
    "attack_surface": "backend",
    "status": "open",
    "severity": "critical",
    "severity_score": 90,
    "type": "open_source",
    "rule": null,
    "cve_id": "AIKIDO-2020-123",
    "cve_id_alias": "CVE-2020-7598",
    "affected_package": "minimist",
    "affected_file": "package-lock.json",
    "first_detected_at": 1700489005,
    "code_repo_id": 1,
    "code_repo_name": "test-service",
    "container_repo_id": null,
    "container_repo_name": null,
    "cloud_id": null,
    "cloud_name": null,
    "domain_id": null,
    "domain_name": null,
    "virtual_machine_id": null,
    "virtual_machine_name": null,
    "ignored_at": null,
    "closed_at": null,
    "sla_remediate_by": 1700924603,
    "snooze_until": null,
    "snooze_reason": "",
    "ignore_reasons": [],
    "issue_type_metadata": {
      "open_source": {
        "installed_version": "4.2.0",
        "patched_versions": ["4.2.6"]
      }
    },
    "how_to_fix": "Upgrade package minimist to 4.2.6 or later.",
    "programming_language": "JS"
  }
]
```

## Activity log fields

Each activity log entry records an action taken on an issue or setting in Aikido, such as ignoring an issue or changing a setting. Aikido sends new entries in the order they happened and doesn't resend entries it already pushed.

| Field              | Type            | Description                                                                                                |
| ------------------ | --------------- | ---------------------------------------------------------------------------------------------------------- |
| `data_type`        | string          | Always `activity_log`.                                                                                     |
| `id`               | integer         | The activity log entry's ID.                                                                               |
| `timestamp`        | unix timestamp  | When the action happened.                                                                                  |
| `comment`          | string          | A human-readable description of the action.                                                                |
| `source`           | string          | What triggered the action. One of `manual`, `checklist`, `rule`, `auto`, `api`.                            |
| `action`           | string          | The action that was taken, for example `ignored`, `snoozed`, `closed`, `re_open`, or `autofix_pr_created`. |
| `user_id`          | integer or null | The ID of the user who took the action. Null when `source` is `auto` or `api`.                             |
| `user_name`        | string or null  | The name of the user who took the action. Null when `source` is `auto` or `api`.                           |
| `issue_id`         | integer         | The ID of the individual issue the action applies to.                                                      |
| `grouped_issue_id` | integer         | The ID of the issue group the action applies to.                                                           |

### Activity log actions

`action` is one of the following:

| Category                    | Values                                                                                                                                                      |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Issue status                | `snoozed`, `unsnoozed`, `ignored`, `auto_ignored`, `closed`, `re_open`, `adjust_severity`, `sla_dates_reset`                                                |
| Issue remediation           | `autofix_pr_created`, `overwrite_license_type`, `license_score_contested`                                                                                   |
| Compliance pushes           | `drata_push`, `sprinto_push`, `thoropass_push`                                                                                                              |
| Exports                     | `issues_exported`, `subdomains_exported`                                                                                                                    |
| Repositories and containers | `repo_activated`, `repo_deactivated`, `container_activated`, `container_deactivated`, `container_registry_activated`, `container_registry_deactivated`      |
| Settings                    | `autofix_settings_changed`, `autoship_settings_changed`, `autodeploy_repo_settings_changed`, `autodeploy_global_settings_changed`, `spending_limit_changed` |
| AI pentest                  | `pentest_paused`, `pentest_resumed`                                                                                                                         |
| Code quality                | `code_quality_finding_ignored`, `code_quality_finding_unignored`                                                                                            |
| Endpoint protection         | `protection_paused`, `protection_paused_all_devices`, `protection_resumed_all_devices`                                                                      |

### Activity log example

```json
[
  {
    "data_type": "activity_log",
    "id": 42,
    "timestamp": 1713586140,
    "comment": "Rick Astley manually ignored this issue",
    "source": "manual",
    "action": "ignored",
    "user_id": 1,
    "user_name": "Rick Astley",
    "issue_id": 10,
    "grouped_issue_id": 3
  }
]
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.aikido.dev/miscellaneous-integrations/siem-connectors/siem-field-reference.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.