Navigate to /Server/Conf, open the In DBParm.ini file, and configure the following parameters. Replace WITFOOIP with the IP of the IP address of the Streamer node to send messages to:
SyslogServerIP=WITFOOIP
SyslogServerPort=514
SyslogTranslatorFile=Syslog\Arcsight.sample.xsl
Save the DBPARM.ini file
Restart the Vault server to apply the configuration changes.
Ensure that the Vault starts successfully and that there are no errors in the log.
Reference: https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PASIMP/Integrating-with-SIEM-Applications.htm