Stream the audit log to your SIEM
Send audit log entries as they happen to an HTTPS webhook or to S3-compatible storage.
For: Workspace admins (Enterprise add-on)Steps
- Open Settings → Audit log streaming and select Add destination.
- Choose HTTPS webhook and enter your collector's public HTTPS URL, or choose S3-compatible storage and enter the bucket, region, optional endpoint and prefix, and an access key.
- Optional: limit the destination to some actions (prefixes such as auth. or security.) or record types.
- Select Save destination. For a webhook, copy the signing secret now — it is shown only once — and use it to verify the webhook-signature header.
- Watch the status, the last delivery and any error on the destination. Batches that still fail after every retry appear under it with a Retry button.
Good to know
- Streaming starts from the moment you save; it doesn't replay older entries. Use Settings → Audit log → Export for those.
- Webhook batches are signed like our outgoing webhooks (Standard Webhooks, HMAC-SHA256). Storage batches are JSON Lines files that are never overwritten.
- Message bodies, secrets and sensitive field values are never streamed.
Still need help? Contact support