> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atlasent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SIEM export

> Stream the AtlaSent audit chain into Splunk, Sumo, Datadog, or any Syslog-compatible endpoint.

Every audit entry can be mirrored into your SIEM as it's created. Use this to:

* Keep AtlaSent audit in the same pane of glass as your other security events.
* Trigger alerts on suspicious patterns (repeated denies, override bursts, unusual agent behavior).
* Satisfy retention requirements that are longer than AtlaSent's default.

## Configure

Console → **Settings → Audit Streaming**. Supported sinks at V1:

| Sink | Transport | Notes |
| - | - | - |
| Splunk | HTTP Event Collector (HEC) | TLS required; HEC token stored encrypted. |
| Sumo Logic | HTTP source | TLS required. |
| Datadog | Logs API | Supports tagged ingestion. |
| Syslog | TCP/TLS (RFC 5424) | Generic fallback; goes to any SIEM that speaks Syslog. |
| S3 | Signed PUT to a bucket you own | Batched every 5 minutes. For cold storage. |

## Event shape

```json theme={null}
{
  "source": "atlasent.audit",
  "ts": "2026-04-19T14:02:18.112Z",
  "audit_id": "aud_01HX6Z8...",
  "actor":  { "id": "agent-001", "type": "ai_agent" },
  "action": { "type": "ehr:write" },
  "target": { "id": "patient-42", "environment": "production" },
  "decision": "allow",
  "policy_id": "pol_21cfr_part11_v3",
  "permit_id": "prm_01HX6Z8...",
  "prev_hash": "b6f9a1e8c4...",
  "entry_hash": "41d73c8b2e..."
}
```

## Alerting suggestions

* **Repeated deny on the same actor / action class within 5 minutes.** Indicates an agent ignoring authorization — possible prompt injection or bug.
* **Override issued.** Should always trigger a review ticket.
* **Audit streaming gap > 60 seconds.** SIEM export is best-effort, but the AtlaSent chain is canonical — a gap means your SIEM has drifted from truth.

## Does SIEM export replace the signed bundle?

No. SIEM export is **convenience**, not evidence. For an FDA or EMA inspection, provide the [signed audit bundle](/quickstart/audit-export) — it's the canonical, verifiable record.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.