Using the SIEM API
The SIEM API allows you to query security-related events associated with your users and organisation in Workvivo. Use it to monitor login activity, user actions, and important system changes for security and auditing purposes.
Requirements
Device: Desktop
Role: Developer
Availability: API access must be enabled for your Workvivo organisation.
Access the SIEM API
The SIEM API is available through Workvivo’s API endpoints. See the Workvivo SIEM API developer documentation for endpoint and authentication details.
Each returned event includes metadata describing the action, when it occurred, and the user involved.
Event fields
| Field | Description |
| created_at_timestamp | The date and time when the event occurred. |
| event | The type of event recorded. |
| ip_address | The IP address associated with the event. |
| user_agent | The device or browser used. |
| workvivo_id | The Workvivo user ID. |
| user_email | The email address of the user involved. |
| note | Additional context, where applicable. |
Supported event types
Availability may vary depending on your organisation’s configuration and authentication method.
Authentication events
| Event | Description |
| login | A user logged in using password-based authentication. |
| loginMobile | A user logged in using password-based authentication on a mobile device. |
| loginSaml | A user logged in using SAML single sign-on. |
| loginSamlFailed | A SAML login attempt failed. The note field includes the affected user’s email address. |
| loginSamlMobile | A user logged in using SAML authentication on a mobile device. |
| logout | A user logged out from a web browser. |
| logoutMobile | A user logged out from a mobile device. |
Multi-factor authentication events
| Event | Description |
| MFA reset | An administrator reset a user’s MFA token. The user_email field identifies the administrator who performed the action. |
| User setup MFA successfully | A user successfully completed MFA setup. |
Password events
| Event | Description |
| user changed password | A user changed their password. This applies to password-based authentication only. |
| password | An administrator updated a user’s password. The note field identifies the affected user. |
| password reset request successful | A password reset request completed successfully. |
| password reset request failure | A password reset attempt failed, typically because the email address was not recognized. |
User switching events
| Event | Description |
| switch user | A user switched into another account through delegation. The real_user field identifies the original user. |
| switch user reverted | The user switched back to their original account. |
System and configuration events
| Event | Description |
| organisation | An organisation setting, such as the timezone or branding, was changed. The user_email field identifies who made the change. |
| App\OrganisationSettings | Organisation-level application settings were updated. |
| permissions | A user role or permission was changed. |
Reporting events
| Event | Description |
| User Requested Report activeUsers | A report for active users was generated. |
| User Requested Report inactiveUsers | A report for inactive users was generated. |
Content events
| Event | Description |
| Data Classification | A user applied a data-classification label to content such as an update, shout-out, article, page, or event. |
Additional information
- Some events may not appear depending on your authentication setup, such as SAML or password-based login.
- MFA events apply only when MFA is enabled in Workvivo, rather than through an external identity provider.