Audit Log Streams

​

Disabling PostgreSQL Audit Log Storage

DISABLE_POSTGRES_AUDIT_LOG_STORAGE=true

​

Overview

1

Create Stream

1. Navigate to Organization Settings
2. Select the Audit Log Streams tab
3. Click Add Log Stream

2

Select Provider

If your log provider is included in this list, select it. Otherwise click on Custom to input your own Endpoint URL and headers.

3

Input Credentials

Depending on your chosen provider, you’ll be asked to input different credentials.For Custom, you need to input an endpoint URL and headers.

Custom endpoints receive audit logs as a JSON array of events per request (batch delivery). Make sure your receiver accepts an array. See Delivery Format for details.

Once you’re finished, click Create Log Stream.

4

Log Stream Created

Your audit logs are now ready to be streamed.

​

Example Providers

Azure

Infisical offers a dedicated Azure provider to stream your audit logs, enabling seamless integration with services like Microsoft Sentinel.

After setting up all Azure resources, it may take 10-20 minutes for logs to begin streaming.

1

Create a Data Collection Endpoint

Navigate to Data Collection Endpoints and click Create.Configure your Data Collection Endpoint by providing an Endpoint Name, Subscription, and a Resource group. Then click Review + Create.After creation, it may take a few minutes for the Data Collection Endpoint to appear. Once visible, click on it and copy the Logs Ingestion URL. You will need this URL in later steps.

2

Create a Log Analytics Workspace

If you already have a Log Analytics Workspace, you may skip this step.

Navigate to Log Analytics Workspaces and click Create.Configure your Log Analytics Workspace by providing a Subscription, Resource group, and a Name. Then click Review + Create.Once the workspace is deployed, click Go to resource to access it.

3

Create a Custom Log Table

Within your Log Analytics Workspace, navigate to Tables and click Create. Select New custom log (DCR-based) from the dropdown.Configure the Custom Log Table: Provide a Table name (e.g., InfisicalLogs), select the Data collection endpoint created in Step 1, and create a new Data collection rule as illustrated in the image below. Then, click Next.On the Schema and transformation page, you’ll be prompted to upload a Log Sample. Create a .json file with the following content and upload it:

{
"id": "00000000-0000-0000-0000-000000000000",
"actor": "user",
"actorMetadata": {
    "email": "user@example.com",
    "userId": "00000000-0000-0000-0000-000000000000",
    "username": "user@example.com"
},
"ipAddress": "0.0.0.0",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36",
"userAgentType": "web",
"eventType": "get-secrets",
"eventMetadata": {},
"orgId": "00000000-0000-0000-0000-000000000000",
"projectId": "00000000-0000-0000-0000-000000000000",
"TimeGenerated": "2025-01-01T00:00:00.000Z"
}

Optionally, you can add Transformations to further destructure the data. For example, to extract actor email and userId:

source
| extend
    ActorEmail = tostring(actorMetadata.email),
    ActorUserId = tostring(actorMetadata.userId)

On the final step, click Create.

It may take a few minutes for your Custom Log Table to be created and appear under Tables.

4

Obtain Data Collection Rule Immutable ID

After creating your Data Collection Rule, you’ll need its Immutable ID.Navigate to Data collection rules. Click on your newly created DCR and copy its Immutable ID for the next step.

5

Create Audit Log Stream on Infisical

In Infisical, create a new audit log stream and select the Azure provider. Input the following details:

• Tenant ID: Your Tenant ID
• Client ID: The Client ID of an App Registration
• Client Secret: The Client Secret of an App Registration
• Data Collection Endpoint URL: Obtained from Step 1
• Data Collection Rule Immutable ID: Obtained from Step 4
• Custom Log Table Name: Defined in Step 3

The App Registration used for authentication must have the Monitoring Metrics Publisher role assigned on the Data Collection Rule created in Step 3. See Microsoft Guide.

Better Stack

You can stream to Better Stack using a Custom log stream.

1

Connect Source

On Better Stack, select Connect Source and click Create source after providing a name.Once your source is created, take note of the endpoint and Source token for the next step.

2

Create Audit Log Stream on Infisical

On Infisical, create a new audit log stream and select the Custom option.

1. Fill in the endpoint URL with your Better Stack source endpoint
2. Create a new header with key Authorization and set the value as Bearer <betterstack-src-token>

Once you’re finished, click Create Log Stream.

Cribl

Stream Infisical audit logs to Cribl Stream for centralized processing and routing. Infisical supports Cribl as a provider for seamless integration.

1

Create Infisical Data Source

In Cribl Stream, navigate to Worker Groups and select your Worker Group. Take note of the Ingress Address for later steps.Within your Worker Group, navigate to Data > Sources > HTTP and click Add Source.Configure the Input ID, Port, and Cribl HTTP event API path (e.g., /infisical). Then, generate an Auth Token.You can optionally configure TLS in the TLS Settings tab and add a pipeline in the Pre-Processing tab.

Ensure that you’re using a port that’s open on your instance.

Once you’ve configured the Data Source, click Save and deploy your changes.

2

Create Audit Log Stream on Infisical

On Infisical, create a new audit log stream and select the Cribl provider option.Input the following credentials:

• Cribl Stream URL: Your HTTP source endpoint composed of http://<ingress-address>:<port>/<http-event-api-path>/_bulk
• Cribl Stream Token: The authentication token from Step 1

If you configured TLS for your Data Source, use the https:// protocol.

Once you’re finished, click Create Log Stream.

Datadog

You can stream to Datadog using the Datadog provider log stream.

1

Navigate to API Keys section

2

Select New Key and provide a key name

3

Create Audit Log Stream on Infisical

On Infisical, create a new audit log stream and select the Datadog provider option.Input your Datadog Region and the Token obtained from step 2.Once you’re finished, click Create Log Stream.

Splunk

You can stream to Splunk using the Splunk provider log stream.

1

Obtain Splunk Token

Navigate to Settings > Data Inputs.Click on HTTP Event Collector.Click on New Token in the top right.Provide a name and click Next.On the next page, click Review and then Submit at the top. On the final page you’ll see your token.Copy the Token Value and your Splunk hostname from the URL to be used for later.

2

Create Audit Log Stream on Infisical

On Infisical, create a new audit log stream and select the Splunk provider option.Input your Splunk Hostname and the Token obtained from step 1.Once you’re finished, click Create Log Stream.

Palo Alto Networks XSIAM

XSIAM accepts log data from external sources via its Custom HTTP Log Collector, which exposes a unique HTTPS endpoint secured by an API key.Infisical’s Custom audit log stream provider sends JSON-formatted audit events to that endpoint, making the integration straightforward.

1

Create an HTTP Log Collector in XSIAM

In your XSIAM tenant, follow Palo Alto’s guide to Set up an HTTP Log Collector to Receive Logs.Configure the collector:

Field	Value
Name	A descriptive name, e.g. Infisical Audit Logs
Vendor	Infisical
Product	Audit Logs

Click Save. XSIAM will generate a Collector URL and an API Key for this instance. Copy both values — you’ll need them in the next step.

The API key is only shown once at creation time. Store it in a secure location before leaving the page.

2

Create Audit Log Stream on Infisical

On Infisical, create a new audit log stream and select the Custom option.

1. Set the Endpoint URL to your XSIAM Collector URL
2. Add a header with key Authorization and value set to your XSIAM API key

Once you’re finished, click Create Log Stream.

​

Delivery Reliability and Failure Handling

​

What happens when an event fails to be pushed to a stream?

1. Automatic retries with backoff. The event is retried automatically up to 5 attempts. Retries use exponential backoff with jitter (starting at 30 seconds and capping at roughly 4 minutes between attempts) so a struggling or rate-limiting destination is not hammered.
2. Exhaustion. If all 5 attempts fail, the event is dropped from the stream. The drop is surfaced for observability through logs and metrics.

​

Can I manually retry a failed event?

​

How can I backfill lost events into my SIEM?

1. Identify the gap. Use error logs (self-hosted), or the time range of the destination outage, to determine which window of events is missing from your SIEM.
2. Export the events from Infisical. Query the missing window from Infisical’s audit logs, filtered by event type, actor, project, and date range:
   • In the UI, under Organization Settings → Audit Logs.
   • Via the Export Audit Logs API, which returns events in the same structure shown below and can be paginated over the affected time range.
3. Re-ingest into your SIEM. Push the exported events into your SIEM using its native ingestion API. The exported fields match the audit log structure below, so the same parsing and transformation rules you already use for the live stream apply to backfilled events.

​

Delivery Format

[
  { "id": "...", "eventType": "create-secret", "...": "..." },
  { "id": "...", "eventType": "get-secrets", "...": "..." }
]

​

Example Log Entry

{
  "id": "7dc1713b-d787-4147-9e21-770be01cc992",
  "actor": "user",
  "actorMetadata": {
    "email": "example@infisical.com",
    "userId": "7383b701-d83f-45c0-acb4-04e138b987ab",
    "username": "example@infisical.com"
  },
  "ipAddress": "127.0.0.1",
  "eventType": "create-secret",
  "eventMetadata": {
    "secretId": "3e5c796e-6599-4181-8dca-51133bb3acd0",
    "secretKey": "TEST-SECRET",
    "secretPath": "/",
    "environment": "dev",
    "secretVersion": 1
  },
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
  "userAgentType": "web",
  "expiresAt": "2025-01-18T01:11:25.552Z",
  "createdAt": "2025-01-15T01:11:25.552Z",
  "updatedAt": "2025-01-15T01:11:25.552Z",
  "orgId": "785649f1-ff4b-4ef9-a40a-9b9878e46e57",
  "projectId": "09bfcc01-0917-4bea-9c7a-2d320584d5b1"
}

​

Audit Logs Structure