Audit Export & SIEM Streaming

Enterprise (audit_export entitlement). Hand security an evidence file, and feed the same events into the SIEM they already alert from. The audit log itself (who did what, to which resource, from which IP) is part of the open-source platform and browsable under Analytics. This feature adds the two things security teams ask for: bulk export for evidence and retention, and streaming into your SIEM.

The Audit Trail under Analytics, with Export CSV and Export JSON

Export

From the Audit Trail tab under Analytics, click Export CSV or Export JSON. Exports are filterable (date range, resourceType, action, userId) and capped at 50,000 rows. The file downloads as an attachment (audit-export-YYYY-MM-DD.json|csv) with an X-Audit-Export-Count header.

CSV columns: id, createdAt, organizationId, userId, userEmail, action, resourceType, resourceId, resourceName, status, ipAddress, details. Admin/owner only. The export endpoint and its query parameters are in the API reference.

SIEM streaming

Register a stream target and audit events are forwarded as they occur. A stream is a target type, an endpoint, a token, and an optional action filter:


{
  "target": "splunk_hec",
  "endpoint": "https://splunk.example.com:8088/services/collector",
  "token": "…",
  "actionFilter": ["credential_use", "agent_delete"]
}

actionFilter is optional: omit it to stream everything. Streams are managed under Settings or the API reference.

Targets

`target`	Auth	Payload
`webhook`	`Authorization: Bearer <token>`	`{"type": "audit.event", "event": {…}}`
`splunk_hec`	`Authorization: Splunk <token>`	HEC event, `sourcetype: almyty:audit`
`datadog`	`DD-API-KEY: <token>`	Datadog Logs API format, `ddsource: almyty`, tagged `action:<action>`

Delivery semantics

Streaming is best-effort: events are sent one at a time, without batching or retries, and a delivery failure never blocks or fails the action that produced the event. Each stream config records its last successful delivery (lastDeliveredAt) and the most recent failure (lastError), so a dead endpoint is visible at a glance. Treat the SIEM copy as an operational feed. The database audit log (and its export) remains the system of record.