---
name: cloud-logs-siem
title: Streaming data from IBM Cloud Logs to SIEM tools
description: You can stream data from IBM Cloud Logs to other corporate tools such as Security Information and Event Management (SIEM) tools.
last-updated: 2025-04-28
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cloud-logs?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Streaming data from IBM Cloud Logs to SIEM tools
{: #siem}

You can stream data from IBM Cloud Logs to other corporate tools such as Security Information and Event Management (SIEM) tools.
{: shortdesc}

Streaming is handled by integrating IBM Cloud Logs with Event Streams.

See [Streaming data](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-streaming&format=markdown) for information about streaming.

You can use Event Streams with IBM Cloud Logs to stream and manage log data. Event Streams is a scalable, managed Apache Kafka service that lets applications send data by creating messages and sending them to a topic. Applications can subscribe to these topics to receive messages, enabling real-time data processing and analytics. 

See [Integrating IBM Cloud Logs with Event Streams](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-streaming-config&format=markdown) for information about configuring the integration.

To [connect to your Event Streams instance](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-connecting&format=markdown#establishing_connection), you need the endpoint URLs for the APIs and the credentials for authentication.

To establish a connection, clients must be configured to use SASL PLAIN or SASL OAUTHBEARER over TLSv1.2 at a minimum and to require a username, and a list of the bootstrap servers. TLSv1.2 ensures that connections are encrypted and validates the authenticity of the brokers (to prevent man-in-the-middle attacks). SASL enforces authentication on all connections. For more information, see [Configuring your Kafka API client](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-kafka_using&format=markdown#kafka_api_client).