> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wolfia.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log Export: Stream Wolfia Activity to Your SIEM or S3

> Send every access and activity event in your Wolfia workspace to Splunk, Datadog, Sumo Logic, Panther, or your own Amazon S3 bucket.

Security and compliance teams need Wolfia activity in the same place as the rest of their audit trail. Wolfia records who did what, when, and from where, and gives you two ways to bring those records into your own tooling: poll them over HTTPS, or have Wolfia deliver them to an S3 bucket you own on a schedule.

Audit log export is available on the Enterprise plan. Configuring it requires the organization admin role.

## What gets recorded

Each event captures the action taken, the person or API key that took it, the affected resource, the source IP address, and a precise timestamp. Events are tagged with the Open Cybersecurity Schema Framework (OCSF) taxonomy, so SIEM tools such as Splunk can parse and categorize them without custom field mapping. Events are retained for seven years by default.

## Choose a delivery method

<CardGroup cols={2}>
  <Card title="Pull over HTTPS" icon="cloud-arrow-down">
    Point any HTTP-polling SIEM at a single endpoint and page through events with a cursor. Best for Splunk HEC, Datadog, Sumo Logic, Panther, and custom collectors.
  </Card>

  <Card title="Push to your S3 bucket" icon="bucket">
    Wolfia assumes an IAM role you control and writes newline-delimited JSON files to your bucket every hour. Best for data lakes and S3-based ingestion pipelines.
  </Card>
</CardGroup>

Both methods deliver the same events in the same shape, so you can switch or run both without reconciling formats.

## Pull events over HTTPS

<Steps>
  <Step title="Create an API key">
    Go to [Settings → API](https://wolfia.com/settings/api) and create an API key. Audit events are sensitive, so the key must belong to an organization admin.
  </Step>

  <Step title="Request the audit events endpoint">
    Send a GET request to `https://api.wolfia.com/v1/audit-events` with your key in the `X-API-Key` header:

    ```bash theme={null}
    curl -H "X-API-Key: $WOLFIA_API_KEY" \
      "https://api.wolfia.com/v1/audit-events"
    ```

    The response contains a list of `events`, a `next_cursor`, and a `has_more` flag.
  </Step>

  <Step title="Page through with the cursor">
    Pass the cursor back on the next request to continue where you left off:

    ```bash theme={null}
    curl -H "X-API-Key: $WOLFIA_API_KEY" \
      "https://api.wolfia.com/v1/audit-events?cursor=<next_cursor>"
    ```

    Store the last cursor between polling runs. Resuming from it guarantees you receive every event exactly where you stopped, with no gaps and no duplicates.
  </Step>

  <Step title="Optional: request newline-delimited JSON">
    Tools that ingest one event per line, such as Splunk HEC or a Sumo Logic HTTP source, can add `Accept: application/x-ndjson`:

    ```bash theme={null}
    curl -H "Accept: application/x-ndjson" \
      -H "X-API-Key: $WOLFIA_API_KEY" \
      "https://api.wolfia.com/v1/audit-events"
    ```

    In this mode the pagination values arrive as `X-Has-More` and `X-Next-Cursor` response headers.
  </Step>
</Steps>

You can also filter to recent activity with the `since_us` query parameter, a microsecond Unix timestamp. The endpoint accepts up to 60 requests per minute, which comfortably covers a polling collector.

## Push events to your S3 bucket

Wolfia never asks for AWS credentials. Instead, you create an IAM role in your own AWS account that trusts Wolfia and allows writing to one bucket, and Wolfia assumes that role each time it delivers a batch.

<Steps>
  <Step title="Create the bucket and IAM role">
    In your AWS account, create (or choose) the destination bucket and an IAM role whose permission policy allows `s3:PutObject` on that bucket. Add a trust policy that lets Wolfia assume the role. For stronger protection, add an external ID condition to the trust policy and enter the same value in Wolfia in the next step.
  </Step>

  <Step title="Enter the configuration in Wolfia">
    Go to [Settings → Audit log export](https://wolfia.com/settings/audit-log-export) as an organization admin. Enter the bucket name and the role ARN, and optionally a key prefix and the external ID. Choose whether to include historical events: when on, Wolfia backfills your full audit history; when off, delivery starts from the moment you enable export.
  </Step>

  <Step title="Save, then test the connection">
    Click **Save configuration**. The **Test connection** and **Run export now** buttons enable once the configuration is saved. Click **Test connection**: Wolfia assumes your role and writes a small probe file to the bucket, and the result (including the full AWS error, if any) appears immediately.
  </Step>

  <Step title="Verify delivery">
    Click **Run export now** to ship the first batch without waiting, then check the **Recent export activity** panel. It shows the last successful export, the number of events shipped, the most recent file written, and the full error message if a delivery failed. After that, Wolfia delivers new events every hour as newline-delimited JSON files organized by date under your key prefix.
  </Step>
</Steps>

## Good practices

* **Store the pull cursor durably.** Treat it like a bookmark: persist it after each successful ingestion run so restarts never re-read or skip events.
* **Use the external ID for S3 export.** It prevents anyone outside your organization from pointing an export at your bucket, even if they learn your role ARN.
* **Watch the Recent export activity panel after setup.** A permissions problem in your bucket policy shows up there with the exact AWS error, which makes the fix obvious.
* **Scope the IAM role tightly.** The role only ever needs `s3:PutObject` on the destination bucket. Nothing else.

## FAQ

<AccordionGroup>
  <Accordion title="Which plan includes audit log export?">
    Audit log export is an Enterprise plan feature. On other plans the settings page shows an upgrade prompt.
  </Accordion>

  <Accordion title="Who can configure it and pull events?">
    Organization admins. The pull endpoint also requires an API key created by an admin.
  </Accordion>

  <Accordion title="How long are events kept?">
    Seven years by default. Contact your Wolfia account team if your compliance program needs a different retention period.
  </Accordion>

  <Accordion title="Why are Test connection and Run export now grayed out?">
    They act on the saved configuration. Enter the bucket and role ARN, click **Save configuration**, and both buttons enable.
  </Accordion>

  <Accordion title="Does polling the audit endpoint create more audit events?">
    No. Reading the audit trail is deliberately excluded from the trail, so a polling collector never generates noise in its own feed.
  </Accordion>

  <Accordion title="Can I run both delivery methods at once?">
    Yes. The pull endpoint and the S3 export draw from the same event stream and produce the same event shape.
  </Accordion>
</AccordionGroup>

## Related pages

<CardGroup cols={2}>
  <Card title="API overview" icon="code" href="/how-to/api-overview">
    Create API keys and learn the basics of authenticating with the Wolfia API.
  </Card>

  <Card title="Service accounts" icon="user-gear" href="/how-to/service-accounts">
    Create service accounts so automation credentials are separate from any individual person.
  </Card>
</CardGroup>