# How to integrate WAF with SIEMs

import DocButton from '~/components/webkit/DocButton.vue';
import Tabs from '~/components/tabs/Tabs'
import Code from '~/components/Code/Code.astro'


Your logs from [Web Application Firewall (WAF)](/en/documentation/products/secure/firewall/web-application-firewall/) can be integrated with SIEM platforms through **Data Stream** to monitor your applications behaviors, performance, and security.

<DocButton href="/en/documentation/products/observe/data-stream/" label="go to Data Stream reference" kind="secondary" size="medium" />

---

<Tabs client:visible>
    <Fragment slot="tab.console">Console</Fragment>
    <Fragment slot="tab.api">API</Fragment>

<Fragment slot="panel.console">
1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Data Stream**.
2. Click **+ Stream**.
3. Choose a unique and easy-to-remember name.
4. On the **Source** dropdown menu, select **Applications**.
5. On the **Template** dropdown menu, select **Applications + WAF Event Collector**.
6. On **Option**, select between **Filter Domains** or **All Current and Future Domains**.
- Find more information on each option on [How to associate domains on Data Stream](/en/documentation/products/guides/data-stream-associate-domains/).
7. On the **Destination** section, select a **Connector** on the dropdown menu: **Standard HTTP/HTTPS POST**, **Apache Kafka**, **Simples Storage Service (S3)**, **Google BigQuery**, **Elasticsearch**, **Splunk**, **AWS Kinesis Data Firehose**, **Datadog**, **IBM QRadar**, **Azure Monitor**, or **Azure Blob Storage**.
- You'll see different fields depending on the endpoint type you choose. Find more information on each of them on the specific guide for the endpoint on the [Observe guides section](/en/documentation/products/guides/#observe).
8. Click the **Save** button.
</Fragment>

<Fragment slot="panel.api">
1. Run the following `POST` request, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/): 

<Code lang="bash" code={`curl --request POST \
  --url https://api.azion.com/v4/data_stream/streams \
  --header 'Accept: application/json' \
  --header 'Authorization: Token [TOKEN VALUE]' \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "Conector Kafka",
    "active": true,
    "inputs": [
      {
        "type": "raw_logs",
        "attributes": {
          "data_source": "http"
        }
      }
    ],
    "transform": [
      {
        "type": "sampling",
        "attributes": {
          "rate": 100
        }
      }
    ],
    "outputs": [
      {
        "type": "kafka",
        "attributes": {
          "bootstrap_servers": "infra.my.net:9094,infra.my.net:9094",
          "topic": "mykafka.dts.topic"
        }
      }
    ]
  }'
`} />

:::tip
This example uses the **Apache Kafka endpoint**, but you can change the `endpoint_type` to any of the available endpoints and add the specific mandatory fields. See the available endpoints and their fields in the [Data Stream Endpoints](https://api.azion.com/#04257075-3691-4b5f-b22b-22a5b6653f3f) table.
:::

Wait a few minutes for the changes to propagate and your stream will be created.

:::tip
Check the [Azion API documentation](https://api.azion.com/) to know more about what the Azion API can offer.
:::
</Fragment>

</Tabs>
---