# Log streams to SIEM

## 1. Pick the destination

Dashboard > Monitoring > Streams > Create. Supported: Amazon EventBridge, Azure Event Grid, Datadog, Splunk, Sumo Logic, Segment, webhooks (custom HTTP), and Marketplace integrations (Elastic, Panther, Pangea, etc.). Auth0 ships dashboard templates for Datadog and a Splunk app.

## 2. Create and configure

- Webhook streams: give Auth0 your HTTPS endpoint; it POSTs JSON batches. Your endpoint must respond 2xx quickly; Auth0 retries with backoff on failure.
- EventBridge: Auth0 puts events on your event bus; attach your own rules/targets.
- Set filters: stream only the event types you need (auth events, admin events). Fewer events = lower cost and less PII surface.

## 3. PII

Streams can carry PII (emails, IPs). The stream settings include PII obfuscation options. Decide before enabling: hash or drop fields your SIEM does not need. You become the data controller for exported data.

## 4. Health

Monitor the stream health in the dashboard: failed deliveries, paused streams. A paused stream does not backfill everything; treat stream health as a production alert, not a nice-to-have.

## What streams are for

Security monitoring (failed logins, anomaly events), audit trails, and product analytics (signup funnels). They are not a backup of tenant logs for debugging old incidents; retention in your SIEM is your retention.

## Checklist

- Filters set, PII policy decided, health alerted.
- Do not use streams as your only incident tool; keep tenant-log search skills handy too.