Audit Log Drains now support Datadog, Splunk, and Panther

Audit Log Drains now stream your team's audit events into Datadog, Splunk, and Panther, joining the existing custom HTTPS endpoint and Amazon S3 destinations.

An Audit Log Drain forwards every event from your team's Activity Log, plus additional audit metadata, to the destination you choose. They're available on Enterprise plans.

To create one, go to Drains in your team settings. Click Add Drain, choose Audit Log as the data type, and pick a destination.

Audit Log Drains replace Custom SIEM Log Streaming. If you already stream audit logs to a SIEM, follow the migration guide to move your integration over.

Learn more about Drains in the documentation.