← All keys & policies
Policy·enterprise
Audit log streaming
Tier 1 · HighManagement
Why Tier 1
Grants no access, but switching it off or redirecting it hides everything that follows from the security team.
Configures where enterprise audit log events are streamed, such as a SIEM, and can turn streaming off.
Available on: Enterprise Cloud, EMU, Server. Source
Attack path
An attacker who disables or redirects audit log streaming can operate afterwards without their actions reaching the security team's monitoring pipeline, a classic anti-forensics move.
Mitigations
- Alert separately, for example through a redundant export, whenever streaming settings change
Detect
Alert on audit_log_streaming.destroy, audit_log_streaming.update, audit_log_streaming.create in the audit log.