Audit destinations
The Audit Destinations page (route /audit-destinations) configures how your audit records are streamed outside the portal to an external system such as a SIEM or a log service.
Purpose
Audit records are written for events ranging from authentication and authorisation to API access. By default those records stay inside the portal. An audit destination forwards them to an external system so you can keep a copy in your own logging pipeline and correlate with other sources. See Audit destinations and the web guide’s SIEM event forwarding.
The screen has two parts:
- the streaming toggles at the top, which enable forwarding records to the Agilicus API for access and authorisation events; and
- the destinations table, which lists each destination with its type, location, connector, authentication type, and audit level.
Why use it
- Forward audit events to a SIEM such as Splunk, Elastic, or your corporate log collector.
- Send events through an outbound-only connector so raw, unencrypted traffic never crosses the internet directly (see Sending logs to a SIEM target).
- Keep an independent copy of your audit trail for compliance.
- Review the statistics of a destination to confirm events are being delivered.
When to use it
- When your security team requires logs in a central SIEM.
- When a compliance framework requires an exportable audit trail.
- When you want to monitor access and authorisation events in real time outside the portal.
Prerequisite: permission to configure audit destinations. The page shows a no permissions message otherwise.
How to use it
- Open Organisation > Audit Destinations from the left navigation.
- Choose what to stream to the Agilicus API by toggling Access and Authorization.
- To add a destination:
- Select ADD DESTINATION to add a webhook destination row, then fill in the Name, Location (the webhook URL), Authentication Type, and Audit Level, or
- Select ADD CONNECTOR DESTINATION to send events through one of your connectors.
- Configure the Audit Level for the destination: choose a preset or define a Custom level.
- Review the destination in the table. Use the row’s actions menu to view statistics, manage credentials, or change the audit level.
- To remove a destination, select its row and choose DELETE DESTINATIONS.
Adding a connector destination
The ADD CONNECTOR DESTINATION dialog asks for a name and the connector to forward through. The connector list shows the connectors you have already configured. If you need a new connector, create it under Resources > Connectors first and return here.
Fields and controls reference
Streaming toggles
| Control | Purpose | Default | Notes |
|---|---|---|---|
| Access | Stream access (authentication and access) records to the Agilicus API | On | |
| Authorization | Stream authorisation decision records to the Agilicus API | On |
Destinations table
| Column | Meaning |
|---|---|
| Name | A name for the destination |
| Type | The destination type (for example webhook) |
| Location | Where the events are sent (a URL, or via the Agilicus API) |
| Via Connector | The connector the events are forwarded through, when applicable |
| Authentication Type | The credential type used to authenticate to the destination |
| Audit Level | Which event categories are forwarded (see below) |
| via Agilicus | Whether events are streamed through the Agilicus API |
| Actions | Row menu: View Detailed Statistics, Manage Credentials, Configure Custom Audit Level |
Audit level
The audit level selects which event categories are forwarded to the destination:
| Level | Categories forwarded |
|---|---|
| Access | Access and authentication events |
| Authorization | Authorisation decision events |
| Authentication | Sign-in and multi-factor authentication events |
| API | API access events |
| Logs | Log records |
Select Custom to combine categories. The Configure Custom Audit Level dialog lets you tick each category individually.
Dialogs and popups
Add Connector Destination
Opens from ADD CONNECTOR DESTINATION. Fields: the destination name and the connector to forward through. Use SAVE to create it or CANCEL to back out.
Configure Custom Audit Level
Opens from the row’s actions menu. Tick the categories to forward (Access, Authorization, Authentication, API, Logs) and select Save.
View Detailed Statistics
Opens from the row’s actions menu. Shows the Destination Summary (total dropped and total sent) and a Breakdown by Connector table with per-connector dropped and sent counts, including drop reasons (authorization, build authorization, invalid format, congestion, timeout, rejected, down) and the last sent time. Use this to confirm events are flowing and to diagnose drops.
Manage Credentials
Opens from the row’s actions menu. Lets you set or update the credentials used to authenticate to the destination, including a private key or OAuth details where applicable.
Configuration versus diagnostics versus confirmation
- Configuration: the streaming toggles, the destination itself (name, location, connector, authentication type, and audit level), and its credentials.
- Diagnostics: the View Detailed Statistics dialog reports totals and drop reasons for each connector.
- Confirmation: deleting destinations applies after you select rows and choose DELETE DESTINATIONS; there is no second confirmation step.
Pagination and async behaviour
- The destinations table pages at 25 rows per page.
- Destination changes are asynchronous: after saving, wait a few seconds and reload to confirm. The statistics dialog reflects delivery since the destination was last active.
- Toggling Access or Authorization applies to the Agilicus API stream; the table refreshes to show the updated state.
Troubleshooting
- A destination shows events as dropped: open View Detailed Statistics and check the drop reasons. A drop reason such as authorization or invalid format usually indicates a credential or payload problem at the destination.
- Events are not arriving at my SIEM: confirm the destination type and audit level include the categories you need, and that the connector (if used) is healthy. See Connectors.
- I need a connector but none is listed: create the connector first under Resources > Connectors, then return to ADD CONNECTOR DESTINATION.
- Raw logs must not cross the internet: forward events through an outbound-only connector, converting them to a secure format such as JSON over HTTPS (see Sending logs to a SIEM target).