opschain admin siem update
Included from Basic tier
Partially updates a SIEM forwarder connection by code or id. Only the flags
you pass change; the code and kind are immutable. A supplied HEC token
(--secret-env / --secret-prompt) rotates the stored one — write-only,
never echoed. --event-filter replaces the stored filter: pass an
empty value (--event-filter '') to forward every event again. Fields
belonging to the other kind refuse by name.
NEW_TOKEN=... opschain admin siem update splunk-main --secret-env NEW_TOKEN
Updated SIEM connection splunk-main
opschain admin siem update splunk-main --event-filter 'warn:,error:,audit:,api:security:'
opschain admin siem update soc-syslog --enabled=false
Flags
| Flag | Meaning |
|---|---|
--display-name <name> | Human-readable connection name. |
--endpoint-url <url> | splunk_hec: the HEC collector URL. |
--secret-env <name> | Name of an environment variable holding the replacement Splunk HEC token (never pass the value itself on the command line). |
--secret-prompt | Prompt for the replacement HEC token without echo (reads a line from stdin when piped). |
--syslog-address <host:port> | syslog: the receiver's address. |
--syslog-transport <t> | syslog: udp, tcp or tls. |
--event-filter <prefixes> | Replace the forwarded event-type prefixes, comma-separated; empty forwards every event. |
--enabled | Whether the connection forwards events. Disabling pauses the cursor in place; re-enabling resumes from the paused position. |
--server <url> | Server base URL (default: the active context / OPSCHAIN_SERVER). |
--auth-token <token> | Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login). |
See also
opschain docs cli/admin-siem-show— the connection's current fields and health.