---
description: Stream Report URI account security events into a SIEM, and route Watch alerts into on-call and ticketing tools by webhook or email.
---

# Security Operations

Two feeds leave Report URI for your security tooling, and they answer different questions.

| Feed | Contains | Goes to |
|---|---|---|
| [Audit Trail webhook](/security-operations/audit-trail/) | Every account security event - keys created, settings changed, logins | A SIEM or log platform |
| Watch alerts | A new script, a changed policy, a watcher gone quiet | On-call and ticketing, or [chat](/notifications/) |

The audit trail is the one that belongs in a SIEM. It is a continuous, structured record of who did what in your Report URI account, which is the evidence a reviewer asks for when they want to know whether your monitoring itself was tampered with.

## Two routes out

**Webhook.** An HTTP POST of a JSON body to a URL you choose. This is the right route for anything that accepts an unauthenticated POST at a secret URL - log collectors whose token is part of the endpoint, automation platforms, or a function you write yourself.

**Email.** Watch products also alert by email, and a great many on-call and ticketing systems accept work by email. That turns out to be the practical route into tools that a webhook cannot reach, because our webhook sends a URL and a JSON body and nothing else - **there is no field for a custom header**. A destination that authenticates with `Authorization: Bearer` or an API key header cannot be a direct target.

| Destination expects | Use |
|---|---|
| A secret in the URL | Webhook, directly - [Sentinel](/security-operations/microsoft-sentinel/) |
| HTTP Basic authentication | Webhook, credentials in the URL - [Elasticsearch](/security-operations/elasticsearch/) |
| A bearer or custom header | A small relay - [Splunk](/security-operations/splunk/) |
| An inbound email address | Email - [PagerDuty](/security-operations/pagerduty/) |

Credentials placed in a webhook URL are recorded in your audit trail along with every delivery attempt, so scope them tightly. Each page below says what that means for that destination.

## Pages

- [Audit Trail](/security-operations/audit-trail/) - what the feed contains and how to stream it
- [Microsoft Sentinel](/security-operations/microsoft-sentinel/) - via a Logic App trigger, no header needed
- [Elasticsearch](/security-operations/elasticsearch/) - directly, using Basic authentication
- [Splunk](/security-operations/splunk/) - and the relay pattern for anything else that needs a header
- [PagerDuty](/security-operations/pagerduty/) - raising incidents from Watch alerts by email

## Start Monitoring with Report URI

**Already using us?** The Audit Trail webhook is configured in Account Settings, or on the Teams page for a team.

**New to Report URI?** The Audit Trail webhook is available on Business and Enterprise plans.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)