CHW-3702 SIEMTestDeliveryFailed
SIEM test delivery failed; the configured endpoint was unreachable or rejected the probe — check host/port/token and firewall rules
Default message: SIEM test delivery failed; the configured endpoint was unreachable or rejected the probe — check host/port/token and firewall rules
HTTP status:502(server)
Problem. POST /api/siem/integrations/{id}/test returned 502.
Cause. The SIEM sender (Splunk HEC, Elastic/OpenSearch _bulk, Sentinel/QRadar syslog) could
not reach the configured endpoint or was rejected by it; the
integration’s last_error is also updated via MarkError so the UI
badge surfaces the same reason. Fix. Check host/port/token, the
firewall rules between Chainsaw and the SIEM collector, and any
per-provider header/token requirements. HTTP 502.