Audit Log Integration

Audit Log Integration streams your LoginRadius audit logs to your own SIEM in near real time, with the full request and response context for every consumer API call. Send them to one or more providers, such as Sumo Logic, Splunk, or Grafana, for monitoring, incident investigation, and compliance reporting.

Access: Admin Console → Integration → Audit Log Integration. The LoginRadius team enables and configures the integration for your tenant. If it is not yet available, contact support@loginradius.com.

Supported providers

Enable one or more of the providers below. Each provider lists the fields you configure in the Admin Console, grouped the same way the setup form presents them.

Sync team audit read logs

Per integration

Each integration has its own toggle, so you can send read events to one provider and skip them on another.

On: include read-only Team Audit events, such as log views, alongside change events.
Off: send change events only.

Logstash receives audit records over an HTTP input. Configure the endpoint, then add TLS material and credentials to match how your pipeline is secured.

Endpoint configuration

Endpoint URL

The HTTPS URL of your Logstash HTTP input. LoginRadius sends each audit record to this address as a POST request. Required. Example: https://logstash.example.com:8080.

SSL Authentication

Enables mutual TLS for the connection. Turn it on to present a client certificate and validate the server against a pinned CA. Off by default. When on, the three fields below apply.

Root CA Path

The root CA certificate used to verify the Logstash server certificate during the TLS handshake. Applies when SSL Authentication is on.

Certificate Path

The client certificate LoginRadius presents to Logstash for mutual TLS. Applies when SSL Authentication is on.

Private Key

The private key paired with the client certificate. Stored encrypted and never returned in API responses. Applies when SSL Authentication is on.

Credentials

Username

The username for HTTP basic authentication on the Logstash endpoint. Provide it when your pipeline enforces basic auth.

Password

The password for HTTP basic authentication. Stored encrypted and never returned in API responses.

Splunk ingests audit records through the HTTP Event Collector (HEC). Configure the collector endpoint, then supply the HEC token that authorizes ingestion.

Endpoint configuration

Endpoint URL

The HTTPS URL of your Splunk HTTP Event Collector. LoginRadius POSTs each audit record here as a JSON event payload. Required. Example: https://http-inputs-<deployment>.splunkcloud.com:443/services/collector/event.

Credentials

Token

The HEC token that authorizes ingestion on the collector endpoint. Stored encrypted and never returned in API responses. Required.

Devo receives audit records over its HTTP ingestion endpoint. Configure the endpoint, the target domain and table, then supply the ingestion token.

Endpoint configuration

Endpoint URL

The HTTPS URL of your region-specific Devo HTTP ingestion endpoint, for example https://http-us.devo.io or https://http-eu.devo.io. Required.

Domain

The Devo domain that owns and scopes the ingested records. Required.

Storage Collection

The Devo tag that identifies the target table for the delivered records, for example my.app.audit. Required.

Credentials

Token

The Devo ingestion token that authorizes writes to the endpoint. Stored encrypted and never returned in API responses. Required.

Sumo Logic receives audit records through an HTTP Source on a Hosted Collector. The unique token is embedded in the source URL, so no separate credential is required.

Endpoint configuration

Endpoint URL

The HTTP Source URL from your Sumo Logic Hosted Collector. It embeds a unique, unguessable token, so no separate credential is required. The host is deployment and region specific. Required. Example: https://endpoint6.collection.us2.sumologic.com/receiver/v1/http/<token>.

Grafana receives audit records through the Loki push endpoint on Grafana Cloud. Configure the endpoint, then authenticate with your instance ID and an API token.

Endpoint configuration

Endpoint URL

The base HTTPS URL of your Grafana Cloud Loki endpoint. Do not include the /loki/api/v1/push path. Required.

Credentials

Instance ID

The numeric Grafana Cloud Logs (Loki) user or instance ID, used as the HTTP basic authentication username. Required.

API Token

A Grafana Cloud Access Policy token scoped to logs:write, used as the HTTP basic authentication password. Stored encrypted and never returned in API responses. Required.

Sample log

A single record as delivered to your provider, including the nested request and response captured for the API call. Sensitive identifiers are redacted.

{
"timestamp": "2026-05-20T11:02:29Z",
"request_id": "4aa1ac8e-8438-4b6d-a2ab-11de147268bb",
"app_name": "test-app",
"actor_type": "dashboard",
"uid": "7e2d54a1-9b3c-4f08-b6e7-2c14ab8d31f9",
"event": "create",
"target": "account",
"method": "email",
"metadata": {},
"request": {
  "method": "POST",
  "path": "/api/register",
  "content_type": "application/json",
  "body": {
    "firstname": "Alex",
    "emailid": "alex@test-app.com",
    "password": "***",
    "phoneid": "+14155551234"
  }
},
"response": {
  "status_code": 201,
  "content_type": "application/json"
},
"user_agent": "axios/1.16.1"
}

Need a different integration? For custom requirements, contact LoginRadius Support.

Supported providers

Sync team audit read logs

Logstash

Splunk

Devo

Sumo Logic

Grafana

Microsoft Sentinel

Endpoint configuration

Credentials

Endpoint configuration

Credentials

Endpoint configuration

Credentials

Endpoint configuration

Endpoint configuration

Credentials

Endpoint configuration

Credentials

Sample log

Related Resources