XSIAM Sink Node
The XSIAM Sink node is not generally available in Fleak Data Workflow. The workflow builder offers it only to accounts where it has been enabled. For the connectors that are generally available, see Data Assets.
This page is retained for accounts where it is enabled.
Quick Reference
In Destination, choose Asset Type and Asset Name, then open Configure Pipeline Settings. The fields listed here are the complete set of editable inputs for this Destination type, subject to the stated visibility conditions.
- Asset Type: Choose a Data Asset; UI selection determines the sink type on Save.
- Asset Name: Choose a Data Asset; reference to the selected data asset.
- Batch Size: Configure Pipeline Settings.
Destination has no inline endpoint or credential input. The data asset owns Endpoint URL; its XSIAM or API Key connection profile owns authentication. Asset Information → Edit shows the endpoint as Dataset, but Save rejects a changed endpoint: create a replacement asset for another endpoint, select it in Asset Name, then Save. Rotate an XSIAM profile's credential in Settings → Connection Profiles. API Key profiles are not listed there; to change an API Key profile's key, click the profile name in the asset's Connection Profile card in Data Assets, then use Edit in Configuration.
Configuration
Configuration keys below are relative to the node configuration. Use the field name in the panel when following instructions in the builder; required markers such as an asterisk are not part of the name.
Destination panel
Choose Asset Type and Asset Name first. Type-specific inputs appear in Configure Pipeline Settings after an asset is selected; an asset error can prevent that section from appearing. A missing or unavailable asset is a reference problem, not proof that the connector does not exist.
The fields listed here are the complete set of editable inputs for this Destination type, subject to the stated visibility conditions.
| Field in the panel | Configuration key | Where to edit / when shown |
|---|---|---|
| Asset Type | UI only; no separate config key | Choose a Data Asset; UI selection determines the sink type on Save |
| Asset Name | dataAssetId | Choose a Data Asset; reference to the selected data asset |
| Batch Size | batchSize | Configure Pipeline Settings; required to save Destination — How many records are buffered into a single request. Must be at least 1. Default: 100. Required: Yes. |
Destination has no inline endpoint or credential input. The data asset owns Endpoint URL; its XSIAM or API Key connection profile owns authentication. Asset Information → Edit shows the endpoint as Dataset, but Save rejects a changed endpoint: create a replacement asset for another endpoint, select it in Asset Name, then Save. Rotate an XSIAM profile's credential in Settings → Connection Profiles. API Key profiles are not listed there; to change an API Key profile's key, click the profile name in the asset's Connection Profile card in Data Assets, then use Edit in Configuration.
Legacy panel
Use this section only when the workflow opens the legacy editor. Asset-managed connection values can be read-only; see Managing Data Assets for available edits and the replacement-asset flow.
| Field in the panel | Configuration key | Where to edit / when shown |
|---|---|---|
| XSIAM Credential | credentialId | Legacy panel; read-only when dataAssetId is set, because the asset/profile supplies this value |
| Endpoint URL | endpoint | Legacy panel; read-only when dataAssetId is set, because the asset/profile supplies this value |
| Batch Size | batchSize | Advanced Settings — How many records are buffered into a single request. Must be at least 1. Default: 100. Required: No. |
Overview
The XSIAM Sink node sends events from your workflow to a Palo Alto Networks Cortex XSIAM HTTP Collector endpoint. Each record is serialized to JSON and POSTed directly to the collector — no forwarder or agent sits in between.
Records are sent exactly as they arrive at the node. Any normalization XSIAM expects — field renaming, OCSF mapping, timestamp formatting — should be done by upstream processing nodes, which makes this a natural terminal node for a security data pipeline.
Setting behavior
The asset accepts either an XSIAM connection profile or a bare API Key profile. The unmanaged legacy panel selects its credential with XSIAM Credential.
An XSIAM connection profile can only be created in Settings → Connection Profiles, not while configuring a node or a data asset. Its only field is API Key (required), sent as the Authorization header. When you create an XSIAM dataset inline, the inline option is an API Key profile.
Notes
Engine configuration. The node runs with endpoint (String, required), credentialId (String, required) and batchSize (Integer, optional, default 100, minimum 1). With a data asset selected, endpoint and credentialId are filled in from the asset and its connection profile. credentialId names an API key credential of the form {"key": "<api key>"}.
The credential is sent as-is. The stored API key becomes the Authorization header value with nothing added to it. If your XSIAM collector expects a scheme prefix, include it in the credential value itself.
Records are batched into one request. The collector ingests a whole batch per request: the batch's records are serialized to JSON, joined with newlines, and POSTed as Content-Type: text/plain. Batch Size controls how many records go into each request.
A failed send fails its whole batch. When a POST fails — network error or a non-success status — every record in that batch is recorded as an error. A retry re-sends the entire batch, including records an earlier attempt may have delivered, so treat XSIAM ingestion as at-least-once and expect the occasional duplicate.
Destination takes its endpoint from the data asset and authentication from its XSIAM or API Key profile. Asset Information → Edit shows the endpoint as Dataset, but Save rejects a changed endpoint. Create a replacement asset for another endpoint, select it in Asset Name, and Save. Rotate an XSIAM profile's credential in Settings → Connection Profiles, or open an API Key profile from the profile name in the asset's Connection Profile card and use Edit in Configuration, then re-deploy affected workflows. In a legacy node with a data asset, inline endpoint and credential controls are read-only; an unmanaged legacy node can edit them.
Related Nodes
- Splunk HEC Sink: Send records to Splunk via the HTTP Event Collector
- Datadog Logs Sink: Forward records to Datadog Logs
- Data Assets: Defining the XSIAM dataset
- Connection Profiles: Storing the XSIAM API key