Log Receivers and SIEM forwarding

Scrydon forwards the same versioned Audit Log envelope shown in the product and NDJSON export. A Log Receiver includes audit, workflow, and integrity events by default, so downstream systems do not need separate integrations or joins.

Configure a receiver

Open Settings → Platform → Audit Log → Log Receivers, then create a receiver with:

• a name;
• an HTTPS webhook URL;
• an optional filter by event type, action, resource type, actor, producer, or time range.

Scrydon displays the HMAC secret once. Store it in your SIEM/collector secret store. Multiple receivers can be active at the same time—for example, all events to a data lake and integrity events to an incident-response SIEM.

Verify a delivery

Each request includes:

• X-Scrydon-Timestamp: <unix-ms>;
• X-Scrydon-Signature: v1=<hex HMAC-SHA256>.

Compute HMAC-SHA256 over {timestamp}.{rawBody} using the receiver secret and compare it in constant time. Reject timestamps more than five minutes from the collector's clock before parsing the body.

Delivery behavior

• At least once: deduplicate on the envelope id.
• Durable retries: failed deliveries retry over approximately 34 hours.
• Dead letters: after the retry budget, the delivery remains visible and can be replayed from the receiver row.
• Independent ingestion: a slow or unavailable destination does not block Audit Log appends.

Use the receiver's test action after creation or secret rotation. The receiver health row shows the latest success and failure details.

Envelope and filtering

Every request uses the common envelope documented under Audit Log. Filters operate on its stable fields: type, action, resource.type, actor, producer, and timestamps. Protected rows use the same clearance-aware redaction rules as list and export.

Related

• Audit Log — envelope, integrity, and retention.
• Audit Log catalogue — accepted event values.
• Observability — application logs, metrics, and traces, which are separate from retained Audit Log evidence.