# Audit destinations

1. [Home](https://www.agilicus.com/)
2. [Agilicus AnyX Administrative Web Interface](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/)
3. [Organisation](https://www.agilicus.com/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/)
4. Audit destinations

![](https://www.agilicus.com/www/4ed1f329-featured-anyx-admin-organisationaudit-destinations.png)## Audit destinations

[CONTACT](/contact-us/)

The **Audit Destinations** page (route `/audit-destinations`) configures how your audit records are streamed outside the portal to an external system such as a SIEM or a log service.

![Audit destinations overview](https://www.agilicus.com/www/2446cdd0-audit-destinations-overview.png)    ## Purpose

Audit records are written for events ranging from authentication and authorisation to API access. By default those records stay inside the portal. An **audit destination** forwards them to an external system so you can keep a copy in your own logging pipeline and correlate with other sources. See [Audit destinations](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/audit-and-diagnostics/) and the web guide's [SIEM event forwarding](https://www.agilicus.com/siem-event-forwarding).

The screen has two parts:

- the **streaming toggles** at the top, which enable forwarding records to the Agilicus API for access and authorisation events; and
- the **destinations table**, which lists each destination with its type, location, connector, authentication type, and audit level.

## Why use it

- Forward audit events to a SIEM such as Splunk, Elastic, or your corporate log collector.
- Send events through an outbound-only connector so raw, unencrypted traffic never crosses the internet directly (see [Sending logs to a SIEM target](https://www.agilicus.com/sending-logs-to-a-siem-target)).
- Keep an independent copy of your audit trail for compliance.
- Review the statistics of a destination to confirm events are being delivered.

## When to use it

- When your security team requires logs in a central SIEM.
- When a compliance framework requires an exportable audit trail.
- When you want to monitor access and authorisation events in real time outside the portal.

**Prerequisite**: permission to configure audit destinations. The page shows a *no permissions* message otherwise.

## How to use it

1. Open **Organisation > Audit Destinations** from the left navigation.
2. Choose what to stream to the Agilicus API by toggling **Access** and **Authorization**.
3. To add a destination:

- Select **ADD DESTINATION** to add a webhook destination row, then fill in the **Name**, **Location** (the webhook URL), **Authentication Type**, and **Audit Level**, or
- Select **ADD CONNECTOR DESTINATION** to send events through one of your connectors.

1. Configure the **Audit Level** for the destination: choose a preset or define a **Custom** level.
2. Review the destination in the table. Use the row's actions menu to view statistics, manage credentials, or change the audit level.
3. To remove a destination, select its row and choose **DELETE DESTINATIONS**.

![Add a destination row](https://www.agilicus.com/www/f4bba185-audit-destinations-add-row.png)    ### Adding a connector destination

The **ADD CONNECTOR DESTINATION** dialog asks for a name and the connector to forward through. The connector list shows the connectors you have already configured. If you need a new connector, create it under **Resources > Connectors** first and return here.

![Connector destination dialog](https://www.agilicus.com/www/f4bba185-audit-destinations-connector-dialog.png)    ## Fields and controls reference

### Streaming toggles

| Control | Purpose | Default | Notes |
|---|---|---|---|
| Access | Stream access (authentication and access) records to the Agilicus API | On |  |
| Authorization | Stream authorisation decision records to the Agilicus API | On |  |

### Destinations table

| Column | Meaning |
|---|---|
| Name | A name for the destination |
| Type | The destination type (for example webhook) |
| Location | Where the events are sent (a URL, or via the Agilicus API) |
| Via Connector | The connector the events are forwarded through, when applicable |
| Authentication Type | The credential type used to authenticate to the destination |
| Audit Level | Which event categories are forwarded (see below) |
| via Agilicus | Whether events are streamed through the Agilicus API |
| Actions | Row menu: View Detailed Statistics, Manage Credentials, Configure Custom Audit Level |

### Audit level

The audit level selects which event categories are forwarded to the destination:

| Level | Categories forwarded |
|---|---|
| Access | Access and authentication events |
| Authorization | Authorisation decision events |
| Authentication | Sign-in and multi-factor authentication events |
| API | API access events |
| Logs | Log records |

Select **Custom** to combine categories. The **Configure Custom Audit Level** dialog lets you tick each category individually.

![Custom audit level dialog](https://www.agilicus.com/www/7858e582-audit-destinations-custom-audit-level-dialog.png)    ## Dialogs and popups

### Add Connector Destination

Opens from **ADD CONNECTOR DESTINATION**. Fields: the destination name and the connector to forward through. Use **SAVE** to create it or **CANCEL** to back out.

### Configure Custom Audit Level

Opens from the row's actions menu. Tick the categories to forward (Access, Authorization, Authentication, API, Logs) and select **Save**.

### View Detailed Statistics

Opens from the row's actions menu. Shows the **Destination Summary** (total dropped and total sent) and a **Breakdown by Connector** table with per-connector dropped and sent counts, including drop reasons (authorization, build authorization, invalid format, congestion, timeout, rejected, down) and the last sent time. Use this to confirm events are flowing and to diagnose drops.

![Destination statistics dialog](https://www.agilicus.com/www/9657ae7e-audit-destinations-stats-dialog.png)    ### Manage Credentials

Opens from the row's actions menu. Lets you set or update the credentials used to authenticate to the destination, including a private key or OAuth details where applicable.

## Configuration versus diagnostics versus confirmation

- **Configuration**: the streaming toggles, the destination itself (name, location, connector, authentication type, and audit level), and its credentials.
- **Diagnostics**: the **View Detailed Statistics** dialog reports totals and drop reasons for each connector.
- **Confirmation**: deleting destinations applies after you select rows and choose **DELETE DESTINATIONS**; there is no second confirmation step.

## Pagination and async behaviour

- The destinations table pages at 25 rows per page.
- Destination changes are asynchronous: after saving, wait a few seconds and reload to confirm. The statistics dialog reflects delivery since the destination was last active.
- Toggling **Access** or **Authorization** applies to the Agilicus API stream; the table refreshes to show the updated state.

## Troubleshooting

- **A destination shows events as dropped**: open **View Detailed Statistics** and check the drop reasons. A drop reason such as *authorization* or *invalid format* usually indicates a credential or payload problem at the destination.
- **Events are not arriving at my SIEM**: confirm the destination type and audit level include the categories you need, and that the connector (if used) is healthy. See [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/).
- **I need a connector but none is listed**: create the connector first under **Resources > Connectors**, then return to **ADD CONNECTOR DESTINATION**.
- **Raw logs must not cross the internet**: forward events through an outbound-only connector, converting them to a secure format such as JSON over HTTPS (see [Sending logs to a SIEM target](https://www.agilicus.com/sending-logs-to-a-siem-target)).

## See also

- [Audit and diagnostics](/anyx-guide/agilicus-anyx-administrative-web-interface/concepts/audit-and-diagnostics/)
- [Audit subsystem](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/audit-subsystem/)
- [Authentication audit](/anyx-guide/agilicus-anyx-administrative-web-interface/organisation/authentication-audit/)
- [Connectors](/anyx-guide/agilicus-anyx-administrative-web-interface/resources/connectors/)

## Web guide

- [Audit destinations](https://www.agilicus.com/product-guide/audit-destination)
- [SIEM event forwarding](https://www.agilicus.com/siem-event-forwarding)
- [Sending logs to a SIEM target](https://www.agilicus.com/sending-logs-to-a-siem-target)