# Webhooks and SIEM delivery

Send audit logs to your monitoring platform in near real-time. This works with tools like Splunk, Datadog, and Sumo Logic.

### Add a webhook

<figure><img src="https://3820804400-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfW6XSzJSKsNyZnOkSJPt%2Fuploads%2FTfefcIVdGoSynluOF5oj%2FCleanShot%202026-02-09%20at%2013.05.04%402x.png?alt=media&#x26;token=4c0c203b-8245-42ad-8254-7eb7c2382373" alt=""><figcaption></figcaption></figure>

{% stepper %}
{% step %}

### Open audit log webhooks

Go to **Account Settings → Security → Audit logs**.
{% endstep %}

{% step %}

### Create the webhook

Click **Add webhook**.
{% endstep %}

{% step %}

### Configure

<figure><img src="https://3820804400-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfW6XSzJSKsNyZnOkSJPt%2Fuploads%2FE3z1ludYqa787MOXGWFw%2FCleanShot%202026-02-09%20at%2013.05.44%402x.png?alt=media&#x26;token=dda53a1d-48eb-4f42-b132-dce3d74353b7" alt=""><figcaption></figcaption></figure>

* **Name**: label for the destination
* **URL**: HTTPS endpoint
* **Description**: optional notes
* **Secret key**: optional HMAC signing secret
* **Custom headers**: optional auth headers
* **Timeout**: 1–300 seconds
* **Max retries**: 0–10
  {% endstep %}
  {% endstepper %}

### Filter what gets sent

Filters are per webhook:

* **Categories**
* **Event types**
* **Severities**

Leave filters empty to receive everything.

### Test delivery

1. Click **Test** next to the webhook.
2. Review the delivery result.

### Payload format (example)

{% code title="Webhook payload (example)" %}

```json
{
  "event": "user.login",
  "event_category": "authentication",
  "severity": "low",
  "timestamp": "2026-02-02T14:30:00Z",
  "audit_log": {
    "id": 12345,
    "event_type": "user.login",
    "status": "success",
    "ip_address": "192.168.1.100",
    "user_agent": "Mozilla/5.0...",
    "metadata": {}
  },
  "user": {
    "id": 42,
    "name": "Jane Smith",
    "email": "jane@company.com"
  },
  "account": {
    "id": 1,
    "name": "Acme Corp"
  }
}
```

{% endcode %}

### Verify webhook signatures (optional)

When a secret key is set, verify the `X-Webhook-Signature` header:

```
HMAC-SHA256(secret_key, request_body)
```

### Retries

Failed deliveries retry with exponential backoff:

* 1 min
* 5 min
* 15 min
* 30 min
* 1 hour
* 2 hours