VxCloud
Docs/Guides/Security & identity
📊Security & identity

Every privileged action, in your SIEM

The audit log is append-only and hash-chained. Stream it over WebSocket or pull historic events via REST. Compatible out of the box with Splunk HEC, Datadog Logs, and Elasticsearch bulk-index.

20 minAdvancedAuditSIEMCompliance
Pick how you want to follow along

In the dashboard (UI)

Dashboard → Settings → Integrations → Audit Streaming. The page shows the WebSocket URL, an issued bearer token, and event-type filters. Test the stream live in the page before plumbing it into production.

1

Generate a streaming token

Click "New token". Pick a name and a TTL (default 30 days). The token has read-only audit scope and can be rotated without affecting other API keys.

2

Test in-page

Click "Open test stream". The page subscribes to the WebSocket using the new token and prints the live audit feed. Trigger a test event by deploying anything in another tab — you should see the event appear in real time.

3

Configure your destination

Pick Splunk / Datadog / Elasticsearch / Custom. For each, paste the destination URL and any required headers. VxCloud ships a sample worker config you can paste directly into your existing collector.

4

Verify retention

Settings → Audit → Retention controls how long events are held in VxCloud (90 days default, up to 7 years on enterprise). Streaming to your SIEM extends retention indefinitely on your side.

Stuck halfway through? Email [email protected] — most replies land within an hour during weekdays.

All guides

Was this page helpful?