Every privileged action, in your SIEM
The audit log is append-only and hash-chained. Stream it over WebSocket or pull historic events via REST. Compatible out of the box with Splunk HEC, Datadog Logs, and Elasticsearch bulk-index.
In the dashboard (UI)
Dashboard → Settings → Integrations → Audit Streaming. The page shows the WebSocket URL, an issued bearer token, and event-type filters. Test the stream live in the page before plumbing it into production.
Generate a streaming token
Click "New token". Pick a name and a TTL (default 30 days). The token has read-only audit scope and can be rotated without affecting other API keys.
Test in-page
Click "Open test stream". The page subscribes to the WebSocket using the new token and prints the live audit feed. Trigger a test event by deploying anything in another tab — you should see the event appear in real time.
Configure your destination
Pick Splunk / Datadog / Elasticsearch / Custom. For each, paste the destination URL and any required headers. VxCloud ships a sample worker config you can paste directly into your existing collector.
Verify retention
Settings → Audit → Retention controls how long events are held in VxCloud (90 days default, up to 7 years on enterprise). Streaming to your SIEM extends retention indefinitely on your side.
Stuck halfway through? Email [email protected] — most replies land within an hour during weekdays.
All guidesWas this page helpful?