# Log streams to SIEM
## 1. Pick the destination
Dashboard > Monitoring > Streams > Create. Supported: Amazon EventBridge, Azure Event Grid, Datadog, Splunk, Sumo Logic, Segment, webhooks (custom HTTP), and Marketplace integrations (Elastic, Panther, Pangea, etc.). Auth0 ships dashboard templates for Datadog and a Splunk app.
## 2. Create and configure
- Webhook streams: give Auth0 your HTTPS endpoint; it POSTs JSON batches. Your endpoint must respond 2xx quickly; Auth0 retries with backoff on failure.
- EventBridge: Auth0 puts events on your event bus; attach your own rules/targets.
- Set filters: stream only the event types you need (auth events, admin events). Fewer events = lower cost and less PII surface.
## 3. PII
Streams can carry PII (emails, IPs). The stream settings include PII obfuscation options. Decide before enabling: hash or drop fields your SIEM does not need. You become the data controller for exported data.
## 4. Health
Monitor the stream health in the dashboard: failed deliveries, paused streams. A paused stream does not backfill everything; treat stream health as a production alert, not a nice-to-have.
## What streams are for
Security monitoring (failed logins, anomaly events), audit trails, and product analytics (signup funnels). They are not a backup of tenant logs for debugging old incidents; retention in your SIEM is your retention.
## Checklist
- Filters set, PII policy decided, health alerted.
- Do not use streams as your only incident tool; keep tenant-log search skills handy too.