Skip to main content
Scheduled SIEM export is an Enterprise plan feature. Status: deployed; customer validation pending — it runs in production but has not yet been validated against a customer’s own SIEM (see Enterprise overview). The on-demand console SIEM integration available to all plans is documented at Integrations → SIEM export.
Enterprise SIEM export adds scheduled, high-volume delivery of the full AtlaSent audit chain to your SIEM. Instead of relying on best-effort real-time delivery, you configure a delivery schedule and AtlaSent batches and ships all events since the last successful delivery.

​
Supported vendor formats

Each vendor format serializes the same underlying audit entry to the shape those platforms expect natively — no transformation pipeline needed at the receiving end.

​
Splunk event shape

​
Datadog log shape

​
Elastic bulk document shape

​
Configuring a scheduled export

  1. Navigate to Enterprise → SIEM Export in the AtlaSent Console.
  2. Click Add destination.
  3. Select the vendor format (Splunk, Datadog, or Elastic).
  4. Fill in the destination fields:
  5. Configure the delivery schedule:
  6. Click Test Connection to send a synthetic event and confirm delivery.
  7. Click Save.

​
Schedule configuration details

Scheduled export uses a cursor-based delivery model: AtlaSent records the audit_id of the last successfully delivered event. On the next scheduled run, it queries all events since that cursor and ships them in batches of up to 10,000 events per HTTP request. If a delivery fails:
  • AtlaSent retries the delivery with exponential backoff.
  • If the retries are exhausted, the run is marked abandoned and the cursor does not advance — the next scheduled run will re-attempt the same window.
  • All retry attempts and their HTTP status codes are visible in Enterprise → SIEM Export → Job history.

​
Job history

The Job history table shows all delivery attempts for the last 30 days:

​
Security notes

  • All tokens are stored AES-256-GCM encrypted and are never returned in plaintext after initial save. Rotate via Edit → Token.
  • Requests carry User-Agent: atlasent-siem-export/2.0 and a X-AtlaSent-Org-Id header for destination-side filtering.
  • For Splunk, use a dedicated HEC token scoped to the atlasent index only.
  • For Datadog, use an API key with the logs_write scope only.
  • For Elastic, use an API key with index privilege on the target index only.

​
SIEM export vs. signed audit bundle

SIEM export is a convenience integration — it gives your SOC real-time or near-real-time visibility. It is not a replacement for the signed audit bundle, which is the canonical, cryptographically verifiable record for regulatory inspections. For FDA, EMA, or SOC 2 purposes, always provide the signed bundle — not a SIEM export.