SIEM Integration Hub

Integration Layer
◀ API
Common Interface
MCP
Model Context Protocol
Capabilities
tools/list
tools/call
resources/read
prompts/get
notifications
Protocol Translation
REST → MCP Tools
OAuth/JWT → MCP Auth
Webhooks → MCP Events
Syslog (514) → MCP Ingest
CEF/LEEF → MCP Normalized
GELF/Beats → MCP Streams
SNMP → MCP Telemetry
HEC/S3 → MCP Batch
Secrets ▶
Secret Management
Delinea
Secret Server
Privileged Access Management
SS REST API Endpoints
GET/api/v1/secrets/{id}
POST/api/v1/secrets
POST/api/v1/secrets/{id}/check-out
POST/api/v1/secrets/{id}/check-in
GET/api/v1/secrets/{id}/audits
POST/api/v2/secrets/rotate
MCP Workflow
1
SIEM needs API credentials
2
MCP Server receives tool call
3
MCP fetches secret from Delinea SS
4
Secret injected into SIEM API call
5
Audit log written to both systems
Agent Requirement Key
Required— Must install
Recommended— Recommended
Optional— Optional
No— Agentless
Legend:
SaaS
SaaS/Hybrid
Hybrid
Open Source
Software/SaaS
SYSLOG CEF REPO ● DELINEA
@bertblevins · delinea.com