AWRA Help Center

Streaming is off until you set a destination and switch it on. Once on, new events go out every minute, in order.

Setting A Destination

1. Open Settings → Security & Devices → Audit Log Streaming.
2. Choose a Format:
   • JSON over HTTPS (signed) — a batch of events posted with your token as a Bearer header and an X-Awra-Signature HMAC-SHA256 of the body.
   • Splunk HTTP Event Collector — one HEC event per audit entry, source type awraops:audit.
   • Datadog Logs intake — sent with your API key, source awraops and service awraops-audit.
3. Enter the HTTPS endpoint and the Token. The token is write-only and encrypted at rest; leave it blank on a later edit to keep the stored one.
4. Tick Stream audit events. For a new destination, Start from now skips the existing history; leave it off to send the whole audit log first.
5. Click Save, then Send a test event to check the destination without waiting for activity.

The endpoint must be a public HTTPS address. Private and internal addresses are refused, and redirects are not followed.

What Each Event Carries

The actor, action, module, route, method, IP address, subject record, description and metadata — plus chain_sequence, previous_hash and row_hash. Your SIEM can check that each event follows on from the last, so a gap or an altered row shows up there and not only inside AWRA.

When A Send Fails

• Nothing is skipped. The stream keeps its place and only moves on after the destination answers with success.
• A failed batch is retried with growing gaps, up to an hour apart, and the error is shown on the page.
• The page shows the Status, when events were Last delivered and how many are Waiting to send.

Permissions

• View settings — see the page and its delivery status.
• Edit settings — set the destination, switch streaming on or off and send a test event. Each change is written to the audit log.