portnox/portnox-siem repository overview

⁠Portnox SIEM gateway

The portnox-siem container forwards alerts and activity log data from Portnox Cloud to an on-premises SIEM solution or syslog listener. It polls Portnox Cloud and Azure Service Bus for new events over an outbound TLS connection, then forwards them to the collector you configured. No inbound port forwarding is needed, since all traffic from the container is outbound.

⁠Deploy

You do not need to build the docker run command yourself. When you set up the SIEM integration in Portnox Cloud, it generates the complete command for you, already filled in with the values for that integration. Copy this command and run it as-is, there is no need to change it in any way. For example:

docker run -d --name portnox-siem --restart=on-failure --pull always \
  -e APIUSER=<api_user> \
  -e APIKEY=<api_key> \
  -e GWID=<gateway_id> \
  portnox-siem:latest

⁠Updating

Update the container by redeploying it manually, or automate updates with the portnox-autoupdate container⁠.

⁠Full documentation

For full documentation, see: docs.portnox.com⁠.