> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truthlocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create SIEM destination

> Configure a new real-time audit log streaming destination.

Creates a SIEM streaming destination for the authenticated tenant. Once created with `enabled: true`, audit events begin streaming immediately. Requires the Enterprise tier.

### Parameters

<ParamField body="provider" type="string" required>
  SIEM provider type. One of `splunk`, `datadog`, `cloudwatch`, `elastic`, or `webhook`.
</ParamField>

<ParamField body="endpoint" type="string" required>
  HTTPS URL of the destination. For Splunk, use the HEC endpoint. For Datadog, use the log intake URL. For CloudWatch, use the regional Logs endpoint.
</ParamField>

<ParamField body="token" type="string">
  Authentication token for Splunk, Datadog, or Elastic destinations.
</ParamField>

<ParamField body="access_key_id" type="string">
  AWS access key ID. Required when `provider` is `cloudwatch`.
</ParamField>

<ParamField body="secret_access_key" type="string">
  AWS secret access key. Required when `provider` is `cloudwatch`.
</ParamField>

<ParamField body="secret" type="string">
  Shared secret for HMAC signature verification. Required when `provider` is `webhook`.
</ParamField>

<ParamField body="enabled" type="boolean">
  Whether to start streaming immediately. Defaults to `true`.
</ParamField>

### Responses