Audit streaming to your SIEM
Audit streaming to your SIEM
Send TR-AI’s audit events to Splunk, Datadog or any HTTPS endpoint automatically.
Security teams can receive TR-AI’s audit events in their own monitoring tools. About once a minute, new events are sent in batches; if your endpoint is down, TR-AI keeps them and retries with growing intervals (up to an hour) — nothing is lost and nothing is sent twice in normal operation.
| Event source | Examples |
|---|---|
| Security events | Sign-ins, failed sign-ins, exports, two-factor changes |
| Safety guard | Personal data detected, prompt-injection attempts, blocked replies |
| Agent overrides | Drafts approved, edited or rejected (lengths only, never the text) |
| Escalations | Which rule fired on which ticket |
| API & webhooks | API keys created or revoked, webhooks changed |
| Settings changes | Every settings version with its summary |
- 1Add a destinationTrust & controls → Audit streaming. Choose HTTPS webhook, Splunk HTTP Event Collector (URL + HEC token) or Datadog logs (intake URL + API key).
- 2Send a test eventUse the send button to check the connection before real events flow.
- 3Verify webhook signaturesWebhook requests carry X-TR-Timestamp and X-TR-Signature: sha256=HMAC-SHA256(secret, timestamp + "." + body). The secret is shown once; you can rotate it.
Note:A new destination starts from now — earlier events are not replayed. Ticket text and customer messages are never included.
Tips & tricks
- Alert on safety-guard events with severity critical and on bursts of failed sign-ins.
- Settings-change events make a good change log for compliance reviews.