PreVeil PreVeil SIEM Integration

TL;DR

Overview

PreVeil is an end-to-end encrypted email and file-sharing platform used by organizations—often in defense, legal, and other regulated industries—to secure sensitive data and support compliance frameworks like CMMC and DFARS. The PreVeil SIEM Connector decrypts and exports cryptographically-secured, immutable logs of User, Administrator, and System activity, converting them into a standard format for ingestion into a SIEM. These logs capture events such as file access, email sending, sharing and permission changes, account approval workflows, trusted community (whitelist) changes, and administrative actions. Integrating PreVeil SIEM Logs with Hunters provides security teams with an audit trail of sensitive data access, sharing, and administrative changes across PreVeil's encrypted collaboration platform, enabling detection of anomalous data exfiltration, unauthorized sharing, or account/approval-group tampering.

Supported data types

PreVeil SIEM Logs

Table name: preveil_siem_logs

This data type contains decrypted PreVeil User, Administrator, and System activity logs, forwarded via NXLog in a JSON envelope. The core PreVeil event data is packed into a single delimited Message field (system/category | event_type | user | description), while the surrounding NXLog envelope fields—including Hostname and MessageSourceAddress—record the network origin of the forwarded syslog message. These events cover security-relevant activity such as file access, email sending, access control/sharing changes, trusted community (whitelist) changes, device management, user provisioning/deprovisioning, and approval group/administrative workflows.

Expected format

Logs are expected in JSON format.

{"EventReceivedTime":"2026-11-05T09:35:32.155916+00:00","EventTime":"2026-11-05T09:32:05.636000+00:00","Hostname":"127.0.0.1","Message":"admin | approver_responded_to_request | jsmith2@acmecorp.com | approved an admin approval request","MessageSourceAddress":"127.0.0.1","Severity":"INFO","SeverityValue":2,"SourceModuleName":"tcp","SourceModuleType":"im_tcp","SourceName":"PREVEIL","SyslogFacility":"KERN","SyslogFacilityValue":0,"SyslogSeverity":"INFO","SyslogSeverityValue":6}

Send data to Hunters

Hunters supports the collection of PreVeil logs using S3 List, S3 Notifications, GCP Bucket List, or Azure Block Storage List.

To connect PreVeil logs:

Connect using S3 List or S3 Notifications

1. Route PreVeil logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in this section.

Connect using Azure Block Storage List

1. Route PreVeil logs into an Azure Storage container as block blobs.
2. Once logs are in the container, follow the steps in this section.

Connect using GCP Bucket List

1. Route PreVeil logs into a Google Cloud Storage bucket.
2. Once logs are in the bucket, follow the steps in this section.