Skip to main content
ION doesn’t have a native SIEM connector, but you can pull any ION data into your SIEM by querying the GraphQL API on a schedule. For setup instructions, see API reference.

​
Polling pattern

A typical polling loop:
  1. Read the last_polled_at timestamp from your pipeline’s state store.
  2. Query ION for records where updatedAt > last_polled_at.
  3. Transform and forward the results to your SIEM ingest endpoint.
  4. On success, write the current timestamp as the new last_polled_at.
The data most commonly relevant to SIEM ingestion includes:
  • Runs — production order lifecycle events (created, started, completed, paused).
  • Issues — quality events, nonconformances, and dispositions.
  • Inventory — adjustments, transfers, and lot/serial number changes.
  • Users and roles — membership changes, permission grants, and deactivations.

​
Alternatives to polling

If your architecture can accept inbound HTTPS traffic, webhooks let ION push change events to your endpoint in near-real time, which reduces polling overhead and latency. Webhooks cover the same resources and include the before/after state of the changed record. Use polling when your SIEM sits behind a firewall that blocks inbound connections, or when your compliance posture requires a strict pull-only model.