On this page0
Guide
Forward logs to your SIEM
Stream every event in your Zonitix audit log to Splunk, Datadog, a syslog collector or your own HTTPS endpoint, as it happens.
Before you start
- This is an IT task. It assumes your company already has a SIEM and that you can create a token or a collector address in it. If you do not look after that system yourself, do this together with the person who does. If your company has no SIEM, you do not need this guide.
- You must hold the administrator role. The “Log forwarding (SIEM)” item is hidden for everyone else.
- Your SIEM must be reachable from the internet over TLS. Zonitix refuses plain HTTP, UDP syslog and addresses on a private network.
- Have the credential ready: a Splunk HEC token, a Datadog API key, or a signing secret of at least 16 characters for a webhook. Syslog over TLS needs no secret.
- Saving a destination asks you to confirm it is you: a window titled “Sudo Mode Required” (Sudo Mode is the app’s name for asking for your sign-in again before a sensitive change), which you answer with your passkey or password.
Add a destination
Step 1: Open Log forwarding
Go to Security & ComplianceSecurity SettingsLog forwarding (SIEM). It is in the “Data” group of the Security Settings menu. Click “ADD DESTINATION”.
Step 2: Choose the type
Pick a “Type”. You cannot change it later; to switch, add a new destination.
- “HTTPS webhook”: enter the “Webhook URL (https://)” and a “Signing secret”. Each batch is signed, so your receiver can check it came from Zonitix.
- “Splunk HTTP Event Collector”: enter the “HEC URL (https://)” (the base address is enough), the “HEC token”, and optionally an “Index (optional)” and “Sourcetype”. The Splunk certificate must be publicly trusted.
- “Datadog Logs”: pick your “Datadog site” from the list, enter the “API key”, and optionally “Tags (optional)”.
- “Syslog over TLS (RFC 5424)”: enter the “Collector host” and “TLS port” (6514 by default). If your collector uses a private certificate authority, paste its public certificate into “Collector CA certificate (optional, PEM)”. The certificate is always checked.
Step 3: Name it and choose where to start
Give it a “Name” your team will recognise. Under “Start from”, choose “New events only”, or “All retained history, then new events” to send everything still in the audit log first.
Leave the switch on “Enabled — events are streamed” and click “Add destination”.
Secrets are stored encrypted and never shown again. When you edit a destination later, leave the secret field blank to keep the current one.Step 4: Send a test event
On the destination’s card, click “Send test event”. It sends one marked test event with no company data in it. In your SIEM, look for an event with the action “LOG_FORWARD_TEST”.
What is sent and when
Step 5: Every audit-log event
Everything that lands in your audit log is forwarded: sign-ins, permission and policy changes, approvals, exports, and Zonitix support sessions. Each event carries its time, action, who did it, severity, the part of Zonitix it came from, the client IP address and browser if recorded, the details, and its position in the tamper-evident chain.
Passwords, keys and tokens are removed before an event is written, and removed again before it is sent.
Step 6: If your SIEM is down
Nothing is dropped. Zonitix keeps its place and retries, waiting a little longer each time (up to five minutes between tries), with no time limit. When your SIEM comes back, the waiting events are sent in order. An event may occasionally arrive twice; each carries an id so your SIEM can remove duplicates.
If your SIEM rejects one particular event three times in a row, Zonitix skips that one event so the rest can flow. It stays in the audit log, the card shows a warning naming it, and the skip is itself recorded in the audit log.
Step 7: Watch the card
Each card shows a status (“HEALTHY”, “WAITING FOR FIRST EVENT”, “BEHIND”, “FAILING” or “DISABLED”) plus “Backlog”, “Last delivered”, “Sent” and “Skipped / gaps”. It refreshes on its own while the page is open.
The audit log inside Zonitix
Step 8: Where to read it
Reading, filtering and exporting the log has its own guide, written for any administrator: See who did what (the audit log). In short:
The same events are in SystemSystem Logs. Filter by “Severity”, “User”, “Time Range”, “Search” (text in the details), “Actions” (show only these kinds of event) or “Exclude” (hide these kinds). The kinds of event include sign-ins, failed sign-ins, MFA, users, permissions and roles, denied or blocked attempts, elevation, workflows, automations, sync, finance, signatures, compliance, audit and licensing.
You can also type a question into the box that begins “Ask in plain English”, such as “failed logins in the last week”. The AI model inside your own instance turns the question into filters; it does not read or change the log itself.
Two buttons at the top of the table export the current view to CSV and verify that the audit trail has not been tampered with. A very large export is cut off at the newest 50,000 entries, and the file says so; narrow the time range to get the rest.
Step 9: How long it is kept
Security & ComplianceSecurity SettingsAudit Log Retention (in the “Platform” group) sets “Keep audit entries for”, from 90 days to 10 years. It starts at 90 days until someone chooses. Click “SAVE SETTINGS” to apply it.
Two rules always hold: nothing younger than 90 days is deleted, and nothing is deleted until an archive of it is confirmed in your off-box backup destination. With no off-box destination, entries are kept indefinitely.
What you should see
The test shows “Test event delivered to …” and the event appears in your SIEM.
After the next audit event, the card changes from “WAITING FOR FIRST EVENT” to “HEALTHY” and “Backlog” reads “up to date”.
If something goes wrong
- "Destination refused: … Restricted destination"
- The address resolves to a private, internal or loopback network, which Zonitix will not send to. Use an address your SIEM exposes on the internet over TLS. If your collector only exists on a private network, contact Zonitix support.
- The card shows FAILING with an error, for example after a token change
- Events are held, not lost. Fix the cause (often an expired or wrong token: click Edit and paste the new one), then click Send test event. Delivery resumes from where it stopped.
- The card is BEHIND and you do not want the old events
- Click Skip backlog. The destination restarts from the latest event; the skipped events stay in the audit log and the skip is recorded there.
- The card reports gaps
- The feed was stalled longer than your audit retention, so some events were archived and removed before they could be sent. They are in your off-box audit archive. Fix the feed, or lengthen Audit Log Retention.
- "The signing secret must be at least 16 characters." or "The secret must not contain "<" or ">""
- Generate a longer webhook secret without those two characters. You can have at most 10 destinations.
Still stuck? See When something goes wrong, or Contact Zonitix support.