Audit logs

Connect your API to your customers' SIEM with ease.

Enterprise customers want to keep track of what happens inside your product, in the SIEM their security team already uses. Don't build another integration. We've got you covered.
Try for freeRead the docs

The investigation happens in their SIEM.

That team already has alerts and a retention policy, and the rest of their logs are already there. Your events have to show up in that same place.

Fully customizable

SIEMs come in all shapes and sizes. Your customers can write transformation functions that reshape event payloads into whatever schema or format their SIEM expects.

Data where your customers want it

Audit events land in a bucket or Elasticsearch index they own, so permissions and retention policies are configured on their own terms.

Built-in integration

Svix fully manages the connection to every destination, so there's no extra work for you. Create the message with the Svix API, and we handle the rest.

Audit logs, where your customers want them

Support for all the common destinations that SIEMs can ingest from.

One action, one event

Your event lands as a document in your customer's Elasticsearch index, or as a line in a file in their S3 bucket, in any format they need.

Your API sends
{
  "eventType": "user.login-attempt",
  "payload": {
    "user": "foobar@example.com",
    "outcome": "success"
  }
}
Elasticsearch · audit-logs
TimeActionUserOutcome22:56:32user.login-attemptfoobar@example.comsuccess22:51:04user.createdada@example.comsuccess22:48:11token.createdfoobar@example.comsuccess
_source · user.login-attempt
{
  "eventType": "user.login-attempt",
  "payload": { "user": "foobar@example.com", "outcome": "success" }
}

More Use Cases

See all Advanced Destinations
Data WarehousingStream events to S3, Snowflake, Redshift, and other storage.Streaming AnalyticsStream events to ClickHouse, BigQuery, Snowflake, or Redshift.OpenTelemetrySend events as traces to Datadog, Grafana, or any OTel backend.Polling and FIFOLet customers poll for events, or receive them in strict order.Message QueuesDeliver events to SQS, EventBridge, and RabbitMQ.

How does the SIEM get the events?

Your customer adds a destination in the App Portal. With Elasticsearch or OpenSearch, each event is indexed as a document their security team can search right away. With S3, Google Cloud Storage, or Azure Blob Storage, their SIEM ingests the bucket.

What if their SIEM expects a different shape?

A transformation, a short JavaScript function hosted by Svix, reshapes each event before it's indexed or written to the bucket.

Do I need to change how I send events?

No. You keep calling the same message API. Your customers configure how they want to receive them in the App Portal.

Start sending webhooks today, no credit card required.

Get started for freeRead the docs