Troubleshooting and FAQ
Answers to the questions we hear most often about the SIEM add-on.
I can't see the Security section in Settings
The Security section only appears for company admins whose account has the SIEM add-on enabled. If you don't see it, check that you have an admin role and that the add-on is active. Contact Kolleno support to enable it.
I lost my API key secret
Secrets are shown only once, at creation, and can't be retrieved afterwards. Delete the key and create a new one, then update your SIEM with the new secret.
My feed is empty
Check that SIEM audit logging shows as Active under Settings > Security. Remember that only activity after activation is recorded, and that a since value in the past may return nothing if those events have aged out of the retention window.
My requests are rejected (authentication error)
Confirm the key is Active (not deactivated or deleted) and that your Authorization header is exactly SIEM <key-id>:<secret>. If in doubt, create a fresh key and update your SIEM.
I can't create another key
You can have up to two keys at once. Delete one you no longer need to free up a slot.
How do I change my retention period?
Retention is managed by Kolleno. Contact support to change it.