Skip to main content
The SIEM Export Console lets org admins configure and manage outbound audit event streams without writing any code.
For the audit event schema and alerting patterns, see SIEM export. This page covers the Console UI and destination management.

​
Supported destinations

​
Opening the SIEM Export settings

Navigate to Settings → SIEM Export in the AtlaSent Console (/siem-export). Only org admins can view or modify this page.

​
Adding a destination

  1. Click Add destination.
  2. Select the destination type: Splunk HEC, Elastic, or Generic webhook.
  3. Fill in the required fields:
  4. Click Test Connection to validate reachability and authentication before saving (see below).
  5. Click Save.

​
Test Connection

The Test Connection button sends a single synthetic audit event to the configured endpoint and waits up to 10 seconds for a 2xx response. The test payload is clearly marked:
A green confirmation message appears on success. On failure, the raw HTTP status and error body are shown inline so you can diagnose the issue before saving.
A destination can be saved without a successful test, but deliveries to a failing endpoint will accumulate in the export job history as failed. Fix the endpoint configuration before events pile up.

​
Event types

Select only the event types your SIEM team needs to minimize egress volume.

​
Export job history

Below the destination list, the Export job history table shows the last 7 days of delivery attempts for each destination: Failed deliveries are retried with exponential backoff. An entry that exhausts its retries is not lost from the AtlaSent audit chain, only from the SIEM export stream.

​
Editing or deleting a destination

Click the … menu on any destination row to Edit or Delete it. Deleting a destination stops all future exports to that endpoint immediately. In-flight retries are cancelled.

​
Security

  • Auth tokens are encrypted at rest using AES-256-GCM and are never returned in plaintext after the initial save. To rotate a token, click Edit and enter the new value.
  • For generic webhooks, optionally enable HMAC-SHA256 signature in destination settings. AtlaSent signs the request body with a shared secret and includes the signature in the X-AtlaSent-Signature-256 header.

​
Comparison: Console SIEM export vs. signed audit bundle

SIEM export is a convenience layer on top of the audit chain, not a replacement for it.