Verify SIEM event publishing

Use this when a customer asks whether Jericho is publishing simulation, training, or campaign events to their SIEM.

Before you begin

You need:

• Customer organization.
• SIEM destination type, such as Splunk webhook.
• Event type they expected to receive.
• Approximate timestamp.

Steps

1. Open ActiveAdmin.
2. Find the customer organization.
3. Check whether SIEM/webhook integration status is visible.
4. Record visible configuration state only. Do not expose secrets.

5. Ask the customer for the destination-side evidence:
   • Missing event type.
   • Expected timestamp.
   • Error from their SIEM, if any.
6. If there is no ActiveAdmin visibility, say so plainly and escalate with the customer-provided details.

Expected result

You can determine whether support has enough browser-visible evidence to answer, or whether engineering must verify delivery.

Escalate when

• Webhook credentials are involved.
• Delivery attempts or failures are not visible in ActiveAdmin.
• The customer needs event payload examples not already in public docs.