enabled: true, audit events begin streaming immediately. Requires the Enterprise tier.
Parameters
string
required
SIEM provider type. One of
splunk, datadog, cloudwatch, elastic, or webhook.string
required
HTTPS URL of the destination. For Splunk, use the HEC endpoint. For Datadog, use the log intake URL. For CloudWatch, use the regional Logs endpoint.
string
Authentication token for Splunk, Datadog, or Elastic destinations.
string
AWS access key ID. Required when
provider is cloudwatch.string
AWS secret access key. Required when
provider is cloudwatch.string
Shared secret for HMAC signature verification. Required when
provider is webhook.boolean
Whether to start streaming immediately. Defaults to
true.