How to Export Sekoia Logs

Use the Sekoia.io events search API in three steps. Create a search job (POST /v1/sic/conf/events/search/jobs) with a query and a time window, wait until the job is done, then read its events in pages of up to 1,000. The Export events button in the Events page works too, but it stops at 500 events. For large volumes, Sekoia offers a massive export API and its own sekoia-event-exporter tool.

Sekoia.io is a European SOC platform, and its event store is often the first place its users look during an investigation. Prime Core has 23,983 detection rules, mapped to 676 MITRE ATT&CK techniques. Below is how to get events out, sanitize them, and investigate them for free in LogTotal.

Get Started For Free

Before you start

An API key. Create one in Sekoia.io with permission to search events. Read-only is enough for searching; the massive export needs the SIC_MASSIVE_EXPORT_EVENTS permission.

Your region’s API host. The default is https://api.sekoia.io. Other regions have their own hosts, for example https://api.usa1.sekoia.io.

Query language. The API accepts the same queries as the Events page. The examples below use the classic “dork” syntax (term_lang: dork). Build and test the query in the UI first.

Export with the events search API

API="https://api.sekoia.io/v1"
H="Authorization: Bearer $SEKOIA_API_KEY"

# 1. create the search job
JOB=$(curl -sS -X POST "$API/sic/conf/events/search/jobs" -H "$H" -H 'Content-Type: application/json' \
  -d '{"term": "host.name:\"web-03\"", "earliest_time": "2026-10-19T00:00:00Z", "latest_time": "2026-10-20T00:00:00Z", "term_lang": "dork"}' \
  | jq -r '.uuid')

# 2. wait until the job is done (status 2)
until [ "$(curl -sS -H "$H" "$API/sic/conf/events/search/jobs/$JOB" | jq -r '.status')" = "2" ]; do sleep 3; done

# 3. read the events, 1,000 at a time
TOTAL=$(curl -sS -H "$H" "$API/sic/conf/events/search/jobs/$JOB" | jq '.total')
for ((off=0; off<TOTAL; off+=1000)); do
  curl -sS -H "$H" "$API/sic/conf/events/search/jobs/$JOB/events?limit=1000&offset=$off" | jq -c '.items[]'
done > sekoia_web03_1019.jsonl

Events come back newest first. A job that fails never reaches status 2, so add a timeout if you script this for regular use.

For large exports, start the massive export on a finished job (POST /v1/sic/conf/events/search/jobs/<uuid>/export), wait for the task, then fetch the download link. The sekoia-event-exporter package on PyPI wraps this workflow.

Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the file. 
2. Sanitize. 
3. Review. 

When it goes wrong