Skip to main content
The audit SIEM destination CRUD and automatic streaming integration are not implemented in the current backend. Do not submit provider secrets to those documented contracts or assume events are buffered and retried for 24 hours.

​
Available integration pattern

Use audit events or audit exports to retrieve recorded events, then ingest them into your SIEM through your own connector. Check the operation’s actual authentication, query fields, and output before designing a polling loop. Persist your processing position and deduplicate by event identity. A successful export request is not a completed download. Handle failed jobs and gaps explicitly. Risk-event SIEM export is a separate API capability. It does not configure a destination that receives every platform audit event.

​
Before enabling streaming

A working streaming integration needs tenant isolation, protected destination credentials, authenticated outbound delivery, retry behavior, delivery state, and a verified destination. Those requirements must be implemented and tested before automatic streaming can be advertised.