Skip to main content

Artemis

Forward audit logs to Artemis Security through an HTTP Log Receiver connector. Artemis normalizes each event to OCSF on arrival, so Willow's tool calls, guard catches, prompts, and sessions show up next to your identity, cloud, endpoint, and SaaS activity, ready for Artemis detections, hunts, and investigations.

You create the connector in the Artemis portal, which gives you a receiver URL and a token, then paste both into Willow.

Prerequisites​

  1. Access to an Artemis portal where you can add connectors.
  2. An HTTP Log Receiver connector created in Artemis, with its receiver URL and token.
  3. Network egress allowed from your deployment to the receiver URL on port 443.

Create the connector in Artemis​

  1. In the Artemis portal, go to Connectors > Add a Connector, and choose HTTP Log Receiver.
  2. Give the connector a name, such as Willow Audit Logs.
  3. Copy the URL and Token Artemis shows for the connector. Store the token securely.
  4. Leave the page open: once the first event arrives, you'll validate the connector there.

Add the provider in Willow​

  1. Open Admin > Settings > Log Settings, then select Add Provider.
  2. Choose Artemis as the provider type.
  3. Paste the Receiver URL and Token from the Artemis connector.
  4. Choose which events to send, then select Add Provider and save.
  5. Select the Test button on the provider to send a sample event.
  6. Back in the Artemis portal, select Connect and Validate. The connector switches to enabled once the first event lands.

Configuration fields​

FieldRequiredDescription
Receiver URLYesThe URL shown on the HTTP Log Receiver connector in the Artemis portal. Willow POSTs each event to this endpoint.
TokenYesThe connector token. Sent as Authorization: Bearer <token>.
Anonymous ModeNoToggle to send only statistical data (see Anonymous Mode).

How it works​

Each event is POSTed to the receiver URL as a JSON object, with Content-Type: application/json and Authorization: Bearer <token>. The record itself is the request body, so Artemis sees the same fields documented in Log schemas:

{
  "id": "…",
  "org_id": "org_123",
  "action": "tool_call",
  "created_at": "2024-01-15T10:30:00.000Z",
  "user": { "id": "…", "name": "…", "email": "…" },
  "data": { "…": "…" }
}

In non-anonymous mode the payload includes the user object; in anonymous mode the user object and data payload are omitted. The request timeout is 5 seconds.

Tips​

  • Send all event categories at first. Artemis builds its model of your environment from the full stream and tunes detections to it, so narrower selections give it less to correlate.
  • Use the Log Delivery page in Willow to confirm Artemis is accepting events. Open it from the overflow menu on the Logs page.
  • If your Artemis connector expects a different auth header than Authorization: Bearer, use the Webhook provider with a custom header instead. Note that the webhook wraps each record in { "timestamp", "type", "data" }.

Troubleshooting​

  • 401 / 403 responses: the token does not match the connector. Copy it again from the Artemis portal, or rotate it there and update Willow.
  • 404 responses: confirm the receiver URL is copied exactly from the connector, with nothing added or removed.
  • Connector stays pending in Artemis: send a test event from Willow, then select Connect and Validate again. Confirm outbound egress on port 443 is allowed.

If no logs appear at all, confirm the provider credentials and URL are correct and that outbound egress is allowed. See Log Settings for shared guidance.

On this page