Epic Systems Epic SIEM Integration

TL;DR

Overview

Epic Systems is a widely used electronic health record (EHR) platform (Epic Hyperspace) deployed across healthcare organizations to manage clinical, administrative, and financial data. Epic's security and privacy auditing subsystem can emit security-relevant events — such as authentications, logins, masked data display, and hidden-source access grants — to a SIEM in near real-time, as Common Event Format (CEF) or Log Event Extended Format (LEEF) messages behind a syslog header. These logs capture user access to patient records and application resources, including login/authentication activity, workstation/host identifiers, and sensitive data access/masking events. Integrating Epic SIEM audit logs with Hunters enables security teams to detect unauthorized access to protected health information (PHI), identify insider threats, surface anomalous login patterns, and support HIPAA auditing and compliance requirements. Each event ties a user identity, source workstation/IP, and action together with Epic-specific event-type classifications such as AUTHENTICATION, LOGIN, MASKED_DATA_DISPLAY, and E_HIDDEN_SOURCE_ACCESS_GRANTED.

Supported data types

Epic SIEM Security Audit Logs

Table name: epic_systems_siem

This data type contains security and privacy audit events generated by Epic Hyperspace's auditing subsystem. It covers events such as user authentications, logins, hidden-source access grants, and masked data display actions, each tied to a user identity, source host/IP, workstation, and the resource or data element involved. These events are key for identifying unauthorized or anomalous access to patient records and other protected resources.

Expected format

Hunters accepts Epic SIEM logs in CEF or LEEF. Each line starts with a syslog header (timestamp and host). Both formats carry the same events and land in the same epic_systems_siem table.

CEF example:

Nov 12 19:17:52 10.21.33.101 CEF:0|Epic|Security-SIEM|10.1.0|LOGIN|LOGIN|4|cnt=1 suser=BCNADM^BEACON, ADMIN^BEACADM shost=apphost01 workstationID=GENLWS act=Query end=Nov 12 13:17:46 flag=^^Workflow Logging CLIENTNAME=WkstnA1/EPIC45172 DEP=1160^WI HBS CANCER CLINIC IP=10.44.98.44/10.44.98.45 LOGINLDAPID=BEACADM OSUSR=asmith45 ROLE=BEACON PROJECT TEAM SOURCE=Hyperspace [1] USERJOB=T00062^BEACON ADMIN TEMPLATE

LEEF example (the same event):

Nov 12 19:17:52 10.21.33.101 LEEF:1.0|Epic|Security-SIEM|10.1.0|LOGIN|eventCnt=1	usrName=BCNADM-BEACON, ADMIN-BEACADM	shost=apphost01	resource=GENLWS	action=Query	devTime=Nov 12 2021 13:17:46	devTimeFormat=MMM dd yyyy HH:mm:ss	flag=--Workflow Logging	proto=6	sev=4	CLIENTNAME=WkstnA1/EPIC45172	DEP=1160-WI HBS CANCER CLINIC	IP=10.44.98.44/10.44.98.45	LOGIN_LDAP_ID=BEACADM	OSUSR=asmith45	ROLE=BEACON PROJECT TEAM	SOURCE=Hyperspace [1]	USERJOB=T00062-BEACON ADMIN TEMPLATE

Send data to Hunters

Hunters supports the collection of Epic Systems logs using S3.

To connect Epic Systems logs:

1. Configure Epic Hyperspace's security and privacy auditing subsystem to forward CEF- or LEEF-formatted syslog events to your log collection pipeline. Refer to Epic's own guidance and vendor integration references for syslog CEF/LEEF export configuration, such as:
   • LogRhythm – Syslog Epic Hyperspace (CEF/LEEF)
   • FortiSIEM – Epic EMR/EHR System
   • Epic Open – Operational Documentation
2. Route the resulting Epic SIEM security audit logs into an AWS S3 bucket. If you send both CEF and LEEF, write each format to its own S3 prefix.
3. Once logs are in S3, follow the steps in this section to connect the S3 bucket to Hunters. If you use two prefixes, connect each one separately.