SIEM integration technical overview

Understanding how Meter exports security events to your AWS Kinesis stream

Overview

Meter’s SIEM integration enables real-time export of network security events from your Meter infrastructure to your organization’s security monitoring and analysis tools. This integration uses AWS Kinesis Data Streams to deliver intrusion detection system (IDS) events and DHCP events in CloudEvents format, allowing you to incorporate Meter network telemetry into your existing security operations workflow.

Use cases

• Centralize security event monitoring across your entire technology stack in a single SIEM platform
• Enable custom alerting and correlation rules based on network-level security events
• Track DHCP assignments and client network activity for forensics and troubleshooting
• Meet compliance requirements for security event logging and retention
• Build custom analytics and dashboards for network security insights
• Integrate Meter security detections with incident response automation

Prerequisites

• AWS account with permissions to create and manage Kinesis streams and IAM

  roles

• Meter Dashboard access with SIEM integration permissions

• Basic understanding of AWS IAM cross-account role assumption

• Familiarity with JSON data processing and CloudEvents specification

Event schema

Events are formatted according to the CloudEvents v1.0 specification with Meter-specific data payloads. Meter exports multiple event types including intrusion detection system (IDS) events and DHCP events.

CloudEvents envelope

{
  "specversion": "1.0",
  "id": "b79aa958-147d-58fd-9c5b-40f683ada52b",
  "source": "https://meter.com",
  "type": "com.meter.ids.detection",
  "subject": "0196b087-9ba3-aefe-5c83-96b6bbb3c976",
  "datacontenttype": "application/json",
  "time": "2025-05-08T15:33:19.46948Z",
  "data": { ... }
}

Field	Description
specversion	CloudEvents specification version (always 1.0)
id	Unique event identifier
source	Event origin (always https://meter.com)
type	Event type identifier (e.g., com.meter.ids.detection, com.meter.dhcp)
subject	Network UUID that generated the event
datacontenttype	Content type of the data field (always application/json)
time	ISO 8601 timestamp when the event was observed
data	Event details (see below for event-specific schemas)

Top-level event structure

All events follow this base structure:

Field	Type	Description
network_uuid	string	UUID of the network that generated the event
id	string	Unique event identifier
timestamp	timestamp	Event timestamp
event	oneof	Event payload (one of: ids_event, dhcp_event, test_event)
network_slug	string	Human-readable network identifier

IDS event data structure

When the event type is ids_event, the data field contains detailed information about the security event:

{
  "src_ip": "192.168.1.100",
  "src_port": 54321,
  "dest_ip": "93.184.216.34",
  "dest_port": 443,
  "src_mac": "aa:bb:cc:dd:ee:ff",
  "dst_mac": "11:22:33:44:55:66",
  "flow_id": 1234567890,
  "app_proto": "tls",
  "protocol": "IANA_PROTOCOL_TCP",
  "direction": "DIRECTION_TO_SERVER",
  "type": "TYPE_OOB_PROTECT",
  "alert": {
    "action": "ACTION_ALLOWED",
    "gid": 1,
    "sid": 2024001,
    "rev": 3,
    "rule": "alert tcp any any -> any any (msg:\"ET MALWARE...\"; ...)",
    "signature": "ET MALWARE Suspicious TLS Certificate",
    "category": "A Network Trojan was detected",
    "severity": 1
  },
  "http": {
    "hostname": "example.com",
    "url": "/api/v1/data",
    "user_agent": "Mozilla/5.0...",
    "method": "GET",
    "protocol": "HTTP/1.1",
    "status": 200,
    "content_type": "application/json",
    "length": 1024
  },
  "flow": {
    "pkts_toserver": 15,
    "pkts_toclient": 12,
    "bytes_toserver": 4096,
    "bytes_toclient": 8192,
    "start": "2025-05-08T15:33:10.123Z",
    "end": "2025-05-08T15:33:19.456Z",
    "reason": "timeout"
  }
}

IDS event field reference

Field	Type	Description
src_ip	string	Source IP address of the flow
src_port	uint32	Source port number
dest_ip	string	Destination IP address
dest_port	uint32	Destination port number
src_mac	string	Source MAC address
dst_mac	string	Destination MAC address
flow_id	uint64	Unique identifier for the network flow
app_proto	string	Application layer protocol (e.g., http, tls, dns)
protocol	enum	Transport protocol: IANA_PROTOCOL_UNSPECIFIED (0), IANA_PROTOCOL_ICMP (1), IANA_PROTOCOL_TCP (6), IANA_PROTOCOL_UDP (17), IANA_PROTOCOL_ESP (50), IANA_PROTOCOL_AH (51), IANA_PROTOCOL_ANY (256)
direction	enum	Flow direction: DIRECTION_UNSPECIFIED (0), DIRECTION_TO_CLIENT (1), DIRECTION_TO_SERVER (2)
type	enum	Detection type: TYPE_UNSPECIFIED (0), TYPE_DETECT (1) - passive detection, TYPE_OOB_PROTECT (2) - out-of-band firewall, TYPE_IB_PROTECT (3) - inline IPS
alert	object	Alert details (see Alert object below)
http	object	HTTP-specific metadata when applicable (see HTTP object below)
flow	object	Network flow statistics (see Flow object below)

Alert object

Field	Type	Description
action	enum	Action taken: ACTION_UNSPECIFIED (0), ACTION_ALLOWED (1), ACTION_BLOCKED (2)
category	string	Alert category description
gid	uint32	Generator ID from the rule
sid	uint32	Signature ID from the rule
rev	uint32	Rule revision number
rule	string	Full rule definition that triggered the alert
severity	uint32	Severity level (1=high, 2=medium, 3=low)
signature	string	Human-readable alert signature

HTTP object (when applicable)

Field	Type	Description
hostname	string	HTTP Host header value
url	string	Request URL path
user_agent	string	User-Agent header
content_type	string	Content-Type header
method	string	HTTP method (GET, POST, etc.)
protocol	string	HTTP protocol version
status	uint32	HTTP response status code
length	uint64	Content length in bytes

Flow object

Field	Type	Description
pkts_toserver	uint64	Packet count to server
pkts_toclient	uint64	Packet count to client
bytes_toserver	uint64	Byte count to server
bytes_toclient	uint64	Byte count to client
start	timestamp	Flow start timestamp
end	timestamp	Flow end timestamp
reason	string	Flow termination reason

DHCP event data structure

When the event type is dhcp_event, the data field contains DHCP transaction information:

{
  "packet_type": "PACKET_ACK",
  "tid": 12345678,
  "client_mac": "aa:bb:cc:dd:ee:ff",
  "client_ip": "192.168.1.100",
  "relay_ip": "192.168.1.1",
  "vlan_id": 10
}

DHCP event field reference

Field	Type	Description
packet_type	enum	DHCP packet type: PACKET_UNSPECIFIED (0), PACKET_DISCOVER (1), PACKET_OFFER (2), PACKET_REQUEST (3), PACKET_DECLINE (4), PACKET_ACK (5), PACKET_NACK (6), PACKET_RELEASE (7), PACKET_INFORM (8)
tid	uint32	DHCP transaction ID
client_mac	string	MAC address of the DHCP client
client_ip	string	IP address assigned to or requested by the client
relay_ip	string	IP address of the DHCP relay agent (if applicable)
vlan_id	int32	VLAN ID associated with the DHCP transaction

Best practices

Performance optimization

• Kinesis shard capacity: Ensure your Kinesis stream has adequate shard capacity. Each shard supports 1 MB/sec or 1,000 records/sec. Monitor the IncomingBytes and IncomingRecords CloudWatch metrics.
• Consumer scaling: If processing events with AWS Lambda or other consumers, ensure they can handle the event rate during peak traffic periods.
• Data retention: Configure appropriate retention periods on your Kinesis stream (default 24 hours, maximum 365 days).

Related resources

• Configuring SIEM integration in Dashboard
• Terraform configuration examples
• AWS Kinesis Data Streams documentation
• CloudEvents specification

Need help?

If you run into any issues or have questions, please reach out to our Support Engineering team by opening a ticket via the Dashboard: https://dashboard.meter.com/support

Last updated by Meter Support Engineering on 09/29/2025