Stream your workspace’s audit events to your security information and event management (SIEM) tooling. Generate delivers events to your destinations on a background drainer that runs every 30 seconds.
SIEM export lives in the SIEM export destinations panel inside Admin Settings → System → Audit log. It requires administrator privileges.

​
Destination types

TypeUse for
Generic webhookAny HTTP endpoint that accepts JSON event payloads
Splunk HECSplunk’s HTTP Event Collector
Datadog LogsDatadog’s log intake API
Each destination in the table shows its Name, Type, Last delivered time, and a Status toggle, plus actions to Send test event, Edit, or Delete.

​
Add a destination

1

Open the SIEM panel

On the Audit log page, expand SIEM export destinations and click to add a new destination.
2

Identity

In the first step, enter a Name, choose a Destination type (this is locked after creation), the URL, and an Auth token. Placeholders show the expected URL shape — for example, Splunk’s .../services/collector/event or Datadog’s .../api/v2/logs. Use the Enabled toggle to control whether it’s active.
When editing later, leave the Auth token blank to keep the existing one.
3

Events

In the second step, either keep Deliver every audit event on, or turn it off and choose specific event types from the allowlist to forward only what you need.
4

Save and test

Save the destination, then click Send test event to deliver a probe and confirm your SIEM receives it.
If a destination shows a delivery error, check the URL and auth token, then use Send test event to re-verify. Disabled destinations don’t receive events.

Audit log

The events that get streamed.

Security & SSO

Manage authentication for your workspace.