Stream audit events to your SIEM

Connect a receiver

Open Organization → Connected services → SIEM as an owner or administrator. Add a name, public HTTPS receiver URL and token. Choose a JSON array or NDJSON for generic HTTPS. For Splunk, use its HEC token and the event endpoint ending in /services/collector/event. Save the destination, test delivery, then enable streaming after the test is accepted.

Understand the events

The stream sends each committed event in the tenant governance audit journal, including decisions, execution outcomes and administrative events recorded there. It contains identifiers and audit metadata, with no captured messages, raw arguments or credentials. Revoked-user history remains visible. Independent provider and control-plane audit journals are not automatically included.

Monitor delivery

Inspect pending, accepted, failed and expired counts, the oldest assigned pending event and last acceptance. Temporary failures retry for seven days from the event time. Invalid credentials pause delivery. Terminal delivery records and counts are retained for thirty days from assignment or replay so gaps can be investigated. The source audit journal follows its separate retention policy.

Pause, rotate or replay

Pause preserves work within the recovery window. Credential rotation pauses streaming until the new token passes a test. Use Recovery and credentials to request a replay of retained audit events for a UTC interval. Replay keeps original event IDs and can duplicate events already received. Requests already sent can finish after pause.