Skip to main content
At the end of this page, your organization’s audit events stream to your security tooling. You also know how to read a destination card, replay held batches, and rotate a webhook secret.
This capability needs the plan or higher.

​
Before you start

Before you start, sign in to the dashboard and select the organization you want to work in.
  • You need the Admin role on an Enterprise plan. Other members do not see the SIEM streaming tab.
  • Have your destination details ready. For Splunk you need the HEC endpoint and token. For Amazon S3 you need a bucket, region, and an access key pair. For a webhook you need an HTTPS endpoint URL.
  • For what the audit log records and how to search it, see Search and export the audit log.

​
Open the SIEM streaming tab

Open Settings, select Audit log, then select the SIEM streaming tab. Before any destination exists, the tab shows a Connect your SIEM panel with a single button of the same name. Once destinations exist, a summary bar reads, for example, 2 destinations · all healthy, next to the audit integrity status and an Add destination button. You can have up to 5 destinations. At the limit, the button is disabled and the tab says You’ve reached the maximum of 5 destinations.

​
Connect a destination

Select Connect your SIEM or Add destination. The dialog opens as a three-step wizard with the tabs Destination, Connection, and What to stream.
The Connect your SIEM dialog on the What to stream step, with category checkboxes, the Minimum severity select, and the Send test event button

​
Step 1: Destination

The wizard asks Where should your audit events go? and offers three cards. Select a card and select Continue.

​
Step 2: Connection

Every type starts with a Label, for example Splunk prod. The remaining fields depend on the type. Select Continue once the required fields are filled.
Enter the HEC endpoint, such as https://splunk.acme.com:8088, and the HEC token. The token is stored encrypted, and only its last 4 characters stay visible after saving. Index and the source type are optional. Leave Index empty to use the token’s default index, and keep the default source type tars:audit unless your Splunk administrator has a naming convention.

​
Step 3: What to stream

Choose the event groups to stream, then choose a Minimum severity. You can change both later from Edit destination. The groups are Security & auth, Data access & exports, Billing, Members & org, Product changes, and Privacy & consent. All groups are selected by default. The severity options are Info and above (everything), Warning and above, and Critical only. The six groups do not cover every audit category. Campaign events and TARS Support events belong to no group, so they do not reach a destination even with every group ticked. See How Tars support accesses your organization for where those support actions are auditable.

​
Test and save

1

Select Send test event

Tars creates the destination and sends one sample event. The status text reads Waiting for the destination… while it runs.
2

Read the result

On success the status text turns green and starts with Test event received. On failure a toast shows the destination’s error, and you can fix the connection and test again.
3

If the type is HTTPS Webhook, copy the Signing secret

A Signing secret panel appears below the test result with a copy button. It is shown once. Afterwards only the last 4 characters stay visible.
4

Select Save destination

The button stays disabled until a test succeeds. The new destination card appears in the tab.
Changing a field or a filter after a successful test resets the test. Test again before you save, or the Save destination button stays disabled.

​
Read a destination card

Each destination has its own card in the tab.
  • The header shows the label, a status pill, and the endpoint. The pill reads Healthy, Degraded, Failing, or Paused.
  • The switch pauses or resumes streaming. The Send test event button sends one sample event and toasts Test event delivered or the error.
  • The More actions menu holds Edit destination, Rewind cursor…, and Delete destination.
  • Four tiles show Delivered, Events behind, Last delivery, and Held batches.
  • A Streams: line lists the selected groups, or All categories, and the severity floor.
Below the cards a note explains that events stream in order within about a minute, and that a destination that becomes unreachable is retried automatically. Held events replay once the connection recovers.

​
Handle a failing destination

When a destination is Failing, a red banner appears at the top of the tab, and the card shows the last error with the number of held events.
  • The banner reads, for example, Delivery to “Splunk prod” has been failing since 2 hours ago, then Your security tooling is not receiving new events.
  • Its Fix connection button opens the edit dialog.
  • If the alert email went out, the banner adds Admins were emailed. Admin members receive one email when a destination starts failing, and at most one more every 24 hours while it stays failing.
  • On the card, Replay held events re-ships every held batch, oldest first, and toasts how many batches are replaying.
  • On the card, Update token opens the edit dialog so you can enter a new credential.

​
Review dead letters

A batch that exhausts its delivery retries is kept as a dead letter instead of being lost. When the Held batches tile is above zero, select it to open the Dead letters dialog for that destination. The table shows one row per batch with Spilled, Sequence range, Events, Attempts, Last error, and a Replay badge of pending, succeeded, or failed. Each row has a Replay button, and the header has Replay all with the count of outstanding batches. Succeeded batches stay in the table for the record. When nothing is held, the dialog says No dead-lettered batches.

​
Rewind the cursor

Use Rewind cursor… from the card’s More actions menu to re-send events the destination already received, for example to backfill a new Splunk index. The dialog shows the Current cursor and the Latest sequence, and asks for a Rewind to sequence value.
Re-delivery can duplicate events your SIEM has already indexed. The target must also fall inside the searchable audit window, because archived events cannot be re-shipped.
Enter a sequence below the current cursor and select Rewind cursor. A toast confirms the new cursor and how many events will re-ship.

​
Edit, rotate, or delete

Edit destination opens the dialog on the Connection step, titled Edit destination followed by the label. Secret fields show Leave blank to keep •••• 4f2a, so you only enter a credential when you replace it. The category groups and severity from the wizard are on the same dialog. Select Save changes to apply.

​
Rotate a webhook signing secret

For an HTTPS Webhook destination, the Signing secret row in the edit dialog has a Rotate… button. Selecting it generates a new secret and shows it once with a copy button. The old secret stays valid for 24 hours, so your endpoint can switch without failed verifications.

​
Delete a destination

Delete destination in the More actions menu opens a confirmation that reads Delete SIEM destination?. Streaming stops immediately and undelivered events for that destination are discarded. This cannot be undone.

​
Verify

Trigger an audited action, such as changing a member’s role. Within about a minute the destination card shows a fresh Last delivery time, Events behind returns to 0, and the event appears in your security tooling.