Security Operations
Two feeds leave Report URI for your security tooling, and they answer different questions.
| Feed | Contains | Goes to |
|---|---|---|
| Audit Trail webhook | Every account security event - keys created, settings changed, logins | A SIEM or log platform |
| Watch alerts | A new script, a changed policy, a watcher gone quiet | On-call and ticketing, or chat |
The audit trail is the one that belongs in a SIEM. It is a continuous, structured record of who did what in your Report URI account, which is the evidence a reviewer asks for when they want to know whether your monitoring itself was tampered with.
Two routes out
Webhook. An HTTP POST of a JSON body to a URL you choose. This is the right route for anything that accepts an unauthenticated POST at a secret URL - log collectors whose token is part of the endpoint, automation platforms, or a function you write yourself.
Email. Watch products also alert by email, and a great many on-call and ticketing systems accept work by email. That turns out to be the practical route into tools that a webhook cannot reach, because our webhook sends a URL and a JSON body and nothing else - there is no field for a custom header. A destination that authenticates with Authorization: Bearer or an API key header cannot be a direct target.
| Destination expects | Use |
|---|---|
| A secret in the URL | Webhook, directly - Sentinel |
| HTTP Basic authentication | Webhook, credentials in the URL - Elasticsearch |
| A bearer or custom header | A small relay - Splunk |
| An inbound email address | Email - PagerDuty |
Credentials placed in a webhook URL are recorded in your audit trail along with every delivery attempt, so scope them tightly. Each page below says what that means for that destination.
Pages
- Audit Trail - what the feed contains and how to stream it
- Microsoft Sentinel - via a Logic App trigger, no header needed
- Elasticsearch - directly, using Basic authentication
- Splunk - and the relay pattern for anything else that needs a header
- PagerDuty - raising incidents from Watch alerts by email
Start Monitoring with Report URI
Already using us? The Audit Trail webhook is configured in Account Settings, or on the Teams page for a team.
New to Report URI? The Audit Trail webhook is available on Business and Enterprise plans.