Stream the audit log to Splunk, Datadog or your own endpoint

On the Enterprise plan, admins send each new audit log entry to a SIEM as it happens. Entries arrive within seconds, and wrkflow retries for about six hours when the destination can’t be reached.

Pick a format

• Splunk HTTP Event Collector: the collector URL and a HEC token.
• Datadog Logs: your Datadog site’s intake URL and an API key.
• Signed JSON: any HTTPS endpoint. wrkflow generates a signing secret, shown once, and sends X-Wrkflow-Signature, an HMAC-SHA256 of the timestamp and the raw body, so you can verify each delivery.

Set up

1. 1Open Integrations, then Audit log streaming, and choose Add destination.
2. 2Choose the format, enter the URL and the token or key. The page keeps the credential out of reach and shows only its last four characters afterwards. For signed JSON, copy the signing secret when it appears.
3. 3Choose Send test event and check Recent activity for a 2xx answer.
4. 4Perform any action that is audited, such as changing a setting, and check that the entry arrives.

What leaves wrkflow

• Every audit log entry: the action, when it happened, the organization, the member who did it (email and name), what it was done to, its details, the IP address and the browser.
• No survey answers: the audit log never holds them.

If something goes wrong

• Deliveries fail with 403: the token or API key was revoked or has no write access. Replace it.
• Deliveries fail without a status code: the destination didn’t answer. Requests leave from wrkflow’s database. If your SIEM allow-lists addresses, ask whoever runs wrkflow for the database’s egress addresses, or put a relay you control in front.
• A failed delivery can be sent again with Retry in Recent activity.

The audit log itself, and how long other data is kept, are in Audit log, data retention and personal data requests. See Integrations for the statuses and how to ask support.