Activity log and SIEM streaming

This page is for a workspace Admin or a security reviewer. The activity log records who changed what in the workspace. You can read it in Veriom, export it, or stream it to your own systems.

Read the activity logCopy Anchor Link

Open Settings and select Activity log. Every member can read it.

Each entry shows who acted, what they did, and on which resource. Secrets and sensitive values are redacted. Entries cannot be edited or deleted. Use the filters and date range to narrow the list, and Load more to page back.

How long entries are kept depends on your plan. See Plans and billing.

Export the activity log as CSVCopy Anchor Link

1. In Activity log, set the filters and date range you need.
2. Click Export CSV and confirm your identity.

You need the Admin or Owner role. One export holds up to the newest 50,000 matching events. Narrow the date range to export older events.

Stream to your SIEMCopy Anchor Link

Streaming sends each new event to an HTTPS endpoint as it happens. It is part of the Growth and Enterprise plans.

1. Open Integrations and select the Apps tab.
2. Find Stream to SIEM.
3. Enter a Name and the HTTPS endpoint. The endpoint must use HTTPS on port 443.
4. Choose the Format (webhook or SIEM) and the Events to send: the activity log or finding changes. Create a second stream to send both.
5. Click Create stream and confirm your identity.
6. Copy the signing secret. Veriom shows it once. Use it to verify that events come from Veriom.
7. Click Send test to check your endpoint.

A workspace can have up to 10 streams.

Manage a streamCopy Anchor Link

If 10 deliveries in a row fail, or your endpoint rejects 3 in a row, Veriom pauses the stream. It emails Owners and Admins who opted in to that notification.

If something goes wrongCopy Anchor Link