Follow Generate an API token, run your Spotter query through the Securonix REST API (/ws/spotter/index/search), and save the events as JSON. When the source sent raw text, the original line is usually kept in the raw event field. Spotter in the UI can export results too.
Securonix pulls in large volumes of activity data for UEBA and SIEM, which makes it a rich place to export an investigation slice from. Prime Core has 14,283 detection rules for Securonix, mapped to 620 MITRE ATT&CK techniques. Below is how to get data out, sanitize it, and investigate it for free in LogTotal.
Before you start
API access. You need a Securonix user that’s allowed to use the API. Tokens are generated with that user’s credentials and have a validity period you choose.
Your tenant URL. Cloud tenants usually look like https://<tenant>.securonix.net/Snypr.
Retention. Hot data is searchable directly in Spotter. Older data may sit in long-term storage that needs extra steps to search.
Export with the REST API
BASE="https://<tenant>.securonix.net/Snypr"
# 1. token, valid for one day
TOKEN=$(curl -sS -H "username: $SNX_USER" -H "password: $SNX_PASS" -H "validity: 1" \
"$BASE/ws/token/generate")
# 2. Spotter query for a time window
curl -sS -G -H "token: $TOKEN" "$BASE/ws/spotter/index/search" \
--data-urlencode 'query=index=activity AND devicehostname="web-03"' \
--data-urlencode 'eventtime_from=10/19/2026 00:00:00' \
--data-urlencode 'eventtime_to=10/20/2026 00:00:00' \
> snx_web03_1019.json
# 3. one event per line
jq -c '.events[]' snx_web03_1019.json > snx_web03_1019.jsonl
Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the file.
- Sanitize. Look it over before you continue.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| Token request fails | Wrong credentials, or the user can’t use the API | Check the user’s API permission |
| Empty results | Query syntax, or the date format doesn’t match | Test the query in Spotter; check the format |
| Only part of the results | Paging not followed | Request the following pages with the query ID |
| Old events missing | Data has moved out of hot storage | Check long-term storage options |
FAQ
Can I export violations and threats instead?
Those are detections and have their own API calls. For LogTotal, export the activity events behind them.
Is Securonix on-premises different?
The API is broadly the same; the base URL is your own server. Check your version’s API guide.
