Sign in
enterprise-admin

Create an audit log streaming configuration for an enterprise

Creates an audit log streaming configuration for any of the supported streaming endpoints: Azure Blob Storage, Azure Event Hubs, Amazon S3, Splunk, Google Cloud Storage, Datadog.

Microsoft Agent365 and Microsoft Purview streams require Microsoft Entra authorization and cannot be created with this endpoint. Configure those destinations from the enterprise audit log streaming settings.

When using this endpoint, you must encrypt the credentials following the same encryption steps as outlined in the guide on encrypting secrets. See "Encrypting secrets for the REST API."

post/enterprises/{enterprise}/audit-log/streams

Path parameters

enterprisestring required

The slug version of the enterprise name.

Request body

enabledboolean required

This setting pauses or resumes a stream.

stream_type'Azure Blob Storage' | 'Azure Event Hubs' | 'Amazon S3' | 'Splunk' | 'HTTPS Event Collector' | 'Google Cloud Storage' | 'Datadog' required

The audit log streaming provider. The name is case sensitive.

Response

The audit log stream configuration was created successfully.

idinteger required
stream_typestring required
stream_detailsstring required
enabledboolean required
created_atstring date-time required
updated_atstring date-time required
paused_atstring date-time nullable

Changes