Audit streaming

Send every audit entry, as it's written, to a signed webhook or Splunk.

Owners can stream the audit log to a SIEM or any HTTPS endpoint under Settings → Audit streaming. Each entry is sent as soon as it's written.

#Signed JSON webhook

Gatehouse sends a POST with the entry as JSON. If you set a secret, each request carries:

X-Gatehouse-Signature: sha256=<hex HMAC-SHA256 of the raw body, keyed with your secret>

Verify it before trusting the body. In Node.js:

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(rawBody, header, secret) {
  const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
  return header.length === expected.length && timingSafeEqual(Buffer.from(header), Buffer.from(expected));
}

#Splunk HTTP Event Collector

Choose Splunk HEC, enter your collector URL (for example https://splunk.example.com:8088/services/collector/event) and put the HEC token in Secret. Gatehouse sends it as Authorization: Splunk <token>.

#Test and monitor

Send a test event posts a sample entry and tells you whether it was delivered. Each entry is retried up to 3 times. The Delivery panel shows whether streaming is healthy, how many entries were delivered since the last restart, and the last error.

The hash-chained log in Gatehouse stays the source of truth. Streaming never changes or drops local entries.

Datadog, Sumo Logic, Elastic and Microsoft Sentinel accept the JSON format through their HTTP intake.

The secret is encrypted with your master key and never shown again after saving.