← All documentation

SIEM forwarding

SIEM forwarding is included in Premium and Enterprise. It is not on the Free
plan.

Settings → SIEM forwards your organization's audit log events to your security information and event management system, in the order they happened. Only an organization admin who was not given admin rights by delegation can change it.

Setting it up

  1. Enter your SIEM's endpoint. It must be a public HTTPS URL; private network addresses are refused.
  2. Optionally enter a token, sent as an Authorization: Bearer header.
  3. Choose the event families to forward, or leave them all unticked to forward every event, and turn forwarding on.
  4. Save, then use Test connection to check your endpoint answers.

How delivery works

  • Each event is queued with its audit-log entry and delivered by a background worker, so nothing in the app waits on your SIEM.
  • A failed delivery is retried, and later events wait behind it so they arrive in order; an event still undelivered is set aside, and Send set-aside events again delivers it.
  • Interactive sign-in and MFA-challenge events are not forwarded, because anyone can trigger them.
  • By default, text your team typed is removed from the event body. Forwarding the full details is an opt-in that asks you to confirm your SIEM is covered for that data.

Changing the endpoint clears the stored token and that confirmation.