SIEM

Stream identity events into your security stack

Every sign-in, permission change, and admin action becomes a normalized event you can forward to the tools your security team already runs. No scraping dashboards, no custom exporters.

Normalized events: Authentication, authorization, user lifecycle, and admin activity in one consistent schema.
Ships to your tools: Datadog, Splunk HEC, Sumo Logic, Sysdig, Slack, and signed generic webhooks.
Durable delivery: Automatic retries with backoff so a transient outage in your collector never drops an event.
Per environment: Route production and staging to different destinations from the same project.

Log streaming

Send events where your team already looks

Configure destinations per environment in the console. Each channel is independently enabled, tested, and retried.

Datadog

Forward identity and security events to Datadog Logs with Authdog-tagged sources for filtering and monitors.

Splunk HEC

Push events to a Splunk HTTP Event Collector endpoint with your own index, source, and sourcetype.

Sumo Logic

Deliver structured JSON events to a Sumo Logic hosted collector for search, dashboards, and alerting.

Sysdig

Emit security-relevant identity activity to the Sysdig Events API alongside your runtime signals.

Signed webhooks

Ship the raw event payload to any HTTPS endpoint and verify it with a shared signing secret.

Slack

Post high-signal security events straight into the channel your on-call team watches.

Audit trail

The record behind every stream

Channels forward what the audit log already captures, so exported events and in-console history never disagree.

Immutable audit log

Append-only history of authentication, authorization, and configuration changes with actor and origin.

Actor and channel context

Every entry records who acted and through which surface, from the console, the API, the CLI, or an agent.

Alert on what matters

Filter the event families you forward so noisy operational traffic never buries a security signal.

Durable retries

Failed deliveries are retried with exponential backoff and surfaced in the console when a channel stays unhealthy.

Compliance reporting

Retain identity evidence in the system your auditors already accept instead of a second silo.

Add a channel

Pick a destination in the console under your environment's notification channels and paste in its endpoint or token.

Send a test event

Verify the connection end to end before you depend on it, and see the exact payload your collector will receive.

Correlate in your SIEM

Join Authdog identity events with the rest of your telemetry to investigate access changes alongside incidents.

Put identity events in front of your security team

Connect a SIEM destination in minutes and start streaming your audit trail where it can be correlated.

Open Console