Stream security events to FortiSIEM (or any SIEM)
DMARC reports tell you about your mail. This feed tells your SOC about your DMARCS account itself: sign-ins, config changes, and the threat signal DMARCS already sees in your reports, as events a SIEM can correlate and alert on.
- Where to find it
- Organization → Integrations → API Access → Manage Keys
- Who can use it
- Organization Admin, to create the key; whoever runs your SIEM or poller after that
- Time needed
- 15 minutes
- You will need
- A SIEM-scoped API key, and something that can poll a URL on a schedule
What the feed sends
Every event falls into one of four categories:
| Category | Examples |
|---|---|
| Authentication & admin activity | Sign-ins, failed logins, password resets, 2FA changes, API key created or revoked, user added or removed, impersonation started and stopped |
| Configuration changes | A domain added, approved or removed; SSO or an integration reconfigured; org settings changed |
| Email threat signal | DMARC failures and malicious senders found in your own reports, a lookalike domain actively sending mail, TLS delivery failures |
| Attack surface | DNSSEC or a security header going missing, subdomain takeover risk, a certificate about to expire, an unexpected new subdomain |
Each event carries a severity from 1 (low) to 10 (high), so you can alert on the sharp end without drowning in routine sign-ins.
Create a SIEM-scoped key
Create a key the same way as any other (see Create an API key), but choose SIEM Read-Only under Choose a scope. A key with this scope can only call the endpoint below; it can't touch domains, reports or anything else the API exposes, so it's safe to hand to a SIEM collector that lives outside your own admin boundary.
Poll the feed
- Request
GET /api/public_api.php?action=siem_events&since_id=0&limit=500- Header
Authorization: Bearer YOUR_SIEM_KEY
Start with since_id=0. Each response includes a next_since_id; save it and pass it back as since_id on your next call so you never see the same event twice. limit defaults to 500 and caps at 1000; has_more tells you whether to poll again immediately or wait for your next scheduled run. When events comes back empty, you're caught up.
Each event in the array carries: id, ts, category, event_type, severity, outcome, actor_email, actor_domain, src_ip, dest_domain, and a detail object specific to that event type.
Connecting FortiSIEM specifically
FortiSIEM doesn't have a generic REST puller built into its GUI, so DMARCS provides a purpose-built parser, correlation rules and a small collector-side poller to bridge the gap. Contact Support for the setup guide; we'll walk through it with you.
Still need a hand?
Email support@dmarcs.com, call +971 4 240 4441, or open a ticket from Support inside the app.