Skip to main content
Security and compliance teams need Wolfia activity in the same place as the rest of their audit trail. Wolfia records who did what, when, and from where, and gives you two ways to bring those records into your own tooling: poll them over HTTPS, or have Wolfia deliver them to an S3 bucket you own on a schedule. Audit log export is available on the Enterprise plan. Configuring it requires the organization admin role.

​
What gets recorded

Each event captures the action taken, the person or API key that took it, the affected resource, the source IP address, and a precise timestamp. Events are tagged with the Open Cybersecurity Schema Framework (OCSF) taxonomy, so SIEM tools such as Splunk can parse and categorize them without custom field mapping. Events are retained for seven years by default.

​
Choose a delivery method

Pull over HTTPS

Point any HTTP-polling SIEM at a single endpoint and page through events with a cursor. Best for Splunk HEC, Datadog, Sumo Logic, Panther, and custom collectors.

Push to your S3 bucket

Wolfia assumes an IAM role you control and writes newline-delimited JSON files to your bucket every hour. Best for data lakes and S3-based ingestion pipelines.
Both methods deliver the same events in the same shape, so you can switch or run both without reconciling formats.

​
Pull events over HTTPS

1

Create an API key

Go to Settings → API and create an API key. Audit events are sensitive, so the key must belong to an organization admin.
2

Request the audit events endpoint

Send a GET request to https://api.wolfia.com/v1/audit-events with your key in the X-API-Key header:
The response contains a list of events, a next_cursor, and a has_more flag.
3

Page through with the cursor

Pass the cursor back on the next request to continue where you left off:
Store the last cursor between polling runs. Resuming from it guarantees you receive every event exactly where you stopped, with no gaps and no duplicates.
4

Optional: request newline-delimited JSON

Tools that ingest one event per line, such as Splunk HEC or a Sumo Logic HTTP source, can add Accept: application/x-ndjson:
In this mode the pagination values arrive as X-Has-More and X-Next-Cursor response headers.
You can also filter to recent activity with the since_us query parameter, a microsecond Unix timestamp. The endpoint accepts up to 60 requests per minute, which comfortably covers a polling collector.

​
Push events to your S3 bucket

Wolfia never asks for AWS credentials. Instead, you create an IAM role in your own AWS account that trusts Wolfia and allows writing to one bucket, and Wolfia assumes that role each time it delivers a batch.
1

Create the bucket and IAM role

In your AWS account, create (or choose) the destination bucket and an IAM role whose permission policy allows s3:PutObject on that bucket. Add a trust policy that lets Wolfia assume the role. For stronger protection, add an external ID condition to the trust policy and enter the same value in Wolfia in the next step.
2

Enter the configuration in Wolfia

Go to Settings → Audit log export as an organization admin. Enter the bucket name and the role ARN, and optionally a key prefix and the external ID. Choose whether to include historical events: when on, Wolfia backfills your full audit history; when off, delivery starts from the moment you enable export.
3

Save, then test the connection

Click Save configuration. The Test connection and Run export now buttons enable once the configuration is saved. Click Test connection: Wolfia assumes your role and writes a small probe file to the bucket, and the result (including the full AWS error, if any) appears immediately.
4

Verify delivery

Click Run export now to ship the first batch without waiting, then check the Recent export activity panel. It shows the last successful export, the number of events shipped, the most recent file written, and the full error message if a delivery failed. After that, Wolfia delivers new events every hour as newline-delimited JSON files organized by date under your key prefix.

​
Good practices

  • Store the pull cursor durably. Treat it like a bookmark: persist it after each successful ingestion run so restarts never re-read or skip events.
  • Use the external ID for S3 export. It prevents anyone outside your organization from pointing an export at your bucket, even if they learn your role ARN.
  • Watch the Recent export activity panel after setup. A permissions problem in your bucket policy shows up there with the exact AWS error, which makes the fix obvious.
  • Scope the IAM role tightly. The role only ever needs s3:PutObject on the destination bucket. Nothing else.

​
FAQ

Audit log export is an Enterprise plan feature. On other plans the settings page shows an upgrade prompt.
Organization admins. The pull endpoint also requires an API key created by an admin.
Seven years by default. Contact your Wolfia account team if your compliance program needs a different retention period.
They act on the saved configuration. Enter the bucket and role ARN, click Save configuration, and both buttons enable.
No. Reading the audit trail is deliberately excluded from the trail, so a polling collector never generates noise in its own feed.
Yes. The pull endpoint and the S3 export draw from the same event stream and produce the same event shape.

API overview

Create API keys and learn the basics of authenticating with the Wolfia API.

Service accounts

Create service accounts so automation credentials are separate from any individual person.