intutic_siem_destination Biz Org+

A SIEM export destination (/api/v1/siem/destinations): where the workspace streams governance events, and which ones. SIEM export needs the Biz Org, Enterprise or Self-host plan (or a trial); on another plan the API refuses to create or change a destination. The adapter's credentials go in secret_config, everything else in config. A webhook_https destination signs every delivery with a secret the API generates, returns once and Terraform keeps as signing_secret; secret_rotation_triggers replaces it. Destroying the resource deactivates the destination: the API has no delete, so it stays listed, switched off. Needs an OWNER or ADMIN key.

Example Usage

# A signed webhook that receives incidents and every gate decision, with a
# signing secret replaced every 90 days.
resource "time_rotating" "siem_webhook" {
  rotation_days = 90
}

resource "intutic_siem_destination" "webhook" {
  name          = "SOC webhook"
  adapter_type  = "webhook_https"
  config        = jsonencode({ webhookUrl = "https://siem.example.com/intutic" })
  secret_config = { authHeaderValue = "Bearer ${var.soc_webhook_token}" }
  source_tables = ["governance_incidents", "gate_decisions"]

  secret_rotation_triggers = {
    rotated = time_rotating.siem_webhook.id
  }
}

# Splunk HTTP Event Collector, default sources.
resource "intutic_siem_destination" "splunk" {
  name          = "Splunk"
  adapter_type  = "splunk_hec"
  config        = jsonencode({ hecUrl = "https://splunk.example.com:8088/services/collector", sourcetype = "intutic" })
  secret_config = { token = var.splunk_hec_token }
}

# The receiver verifies each delivery with this secret.
output "siem_webhook_signing_secret" {
  value     = intutic_siem_destination.webhook.signing_secret
  sensitive = true
}

variable "soc_webhook_token" {
  type      = string
  sensitive = true
}

variable "splunk_hec_token" {
  type      = string
  sensitive = true
}

Schema

Required

• adapter_type (String) One of syslog_cef, webhook_https, gcs, s3, splunk_hec, datadog_logs. Changing it replaces the destination.
• name (String)

Optional

• batch_size (Number) Events per bucket object (gcs, s3). Defaults to 100.
• config (String) The adapter's settings as a JSON object, without its credentials. Required keys: syslog_cef host and port; webhook_https webhookUrl; splunk_hec hecUrl; gcs and s3 bucketName. Optional ones include useTls (syslog), prefix and projectId (gcs), region and accessKeyId (s3), source and sourcetype (splunk), intakeUrl and hostname (datadog). URLs must be public https endpoints.
• enabled (Boolean)
• flush_interval_ms (Number) Longest wait, in milliseconds, before a bucket object is written with fewer events. Defaults to 60000.
• secret_config (Map of String, Sensitive) The adapter's credentials, which the API only ever returns masked: webhook_https authHeaderValue (optional); splunk_hec token; datadog_logs apiKey; gcs credentials (a base64-encoded service-account key); s3 secretAccessKey. A value changed outside Terraform shows as a difference. Removing an optional credential clears it.
• secret_rotation_triggers (Map of String) Arbitrary values that rotate the signing secret when they change. Changing, adding or removing any value replaces a webhook_https destination's signing secret in place on the next apply and stores the new one in signing_secret; the old secret stops working at once. Creating the resource does not rotate, since the API issues a secret then. Only for a webhook_https destination.
• source_tables (Set of String) The event sources to stream, for example governance_incidents or gate_decisions. Empty (the default) streams every source except the opt-in ones; gate_decisions is sent only to a destination that lists it.

Read-Only

• id (String) The destination id (siemdest_…).
• paused_reason (String) Why an enabled destination streams nothing, such as a plan without SIEM export; null while it streams.
• signing_secret (String, Sensitive) For webhook_https: the secret that signs each delivery. Set on create and when secret_rotation_triggers changes; null after an import, since the API returns it only then.

Import

# Import by destination id. Credentials read back masked, so set secret_config
# to the real values. The signing secret is never returned after creation:
# add secret_rotation_triggers to put a new one in state.
terraform import intutic_siem_destination.splunk siemdest_0123456789abcdef