Send the audit log to a SIEM

Your security team can pull every Onplana audit event into the SIEM it already watches. The SIEM polls the Onplana API with a personal access token that carries one scope, Audit log for a SIEM. That token reads your organization’s audit log and nothing else in the API. No Onplana code runs inside your SIEM or your Azure subscription.

Turned on per platform

The Audit log for a SIEM scope appears in the token form once Onplana has turned it on. If you do not see it under Settings > Developer, ask us to turn it on for your workspace.

Before you start

• Your workspace is on the Enterprise plan, which includes the audit log.
• You are an Owner or Admin of the organization.
• You know which SIEM will read the events: Microsoft Sentinel has a ready-made connector below; Splunk, Elastic and Datadog use their generic REST poller.

Create the token

1. Open Settings and go to the Developer tab.
2. Select New token and give it a name your security team will recognise, for example “Sentinel audit feed”.
3. Under scopes, select only Audit log for a SIEM. A token with Full access (all scopes) does not include it, on purpose: the audit feed always has a token of its own.
4. Set an expiry that matches your rotation policy, then create the token and copy it. It starts with pat_ and is shown once.

Creating the token writes an AUDIT_READ_TOKEN_CREATED entry to your organization’s audit log, so the feed itself is on the record. The token reads only while the person who created it is still an Owner or Admin; if they lose that role, the token stops working. See Create API tokens for rotation and revocation.

Microsoft Sentinel

Onplana ships a Sentinel connector built on the Codeless Connector Framework. Download onplana-audit-ccf.json and deploy it to the resource group of your Sentinel workspace.

1. In the Azure portal, open Deploy a custom template, choose Build your own template in the editor and load the file. Or run:

   az deployment group create -g <resource-group> \
     --template-file onplana-audit-ccf.json \
     -p workspace=<sentinel-workspace-name> apiKey=<pat_...>

2. Fill the parameters: workspace (your Sentinel workspace name), apiKey (the token), and optionally pollIntervalMinutes (default 5). Leave apiBaseUrl as https://api.onplana.com unless Onplana runs a dedicated deployment for you, in which case use its API address.

3. Open Microsoft Sentinel > Data connectors. The Onplana Audit Log connector shows as connected after its first poll.

The template creates the OnplanaAudit_CL table, a data collection endpoint and rule, the connector tile and the poller. Each audit event becomes one row with these columns: TimeGenerated, EventId, Action, Resource, ResourceId, UserId, UserEmail, OrganizationId, IpAddress, UserAgent, ActorType, ClientSurface, ClientLabel, IsSystem and Details.

A first query to check the feed:

OnplanaAudit_CL
| where TimeGenerated > ago(1d)
| summarize count() by Action
| order by count_ desc

Splunk, Elastic and Datadog

Point the SIEM’s generic HTTP or REST API poller at the audit log endpoint:

GET https://api.onplana.com/api/audit-logs?since=2026-11-01T00:00:00Z&limit=1000
Authorization: Bearer pat_...

Parameter	What it does
since	Start of the window, an ISO 8601 date and time, inclusive
until	End of the window, an ISO 8601 date and time, exclusive
limit	Events per page, default 100, at most 1000
cursor	The nextCursor from the previous page

The response is { "events": [...], "nextCursor": "...", "hasMore": true }, oldest event first. Keep requesting with cursor set to the last nextCursor while hasMore is true. Because since is inclusive and until is exclusive, back-to-back windows neither overlap nor leave a gap. When a page comes back empty, the same cursor is returned, so the poller keeps its place.

Each token may make 60 requests a minute. Past that, Onplana answers 429 with a Retry-After header in seconds; wait that long and retry.

Errors

Status	Code	Meaning
400	INVALID_SINCE, INVALID_UNTIL	The date is not ISO 8601
400	INVALID_CURSOR	The cursor was not one this endpoint returned
401		The token is wrong, expired or revoked
402		The workspace is not on a plan with the audit log
403	AUDIT_SIEM_READ_DISABLED	The SIEM scope is not turned on yet; contact us
403		The person who created the token is no longer an Owner or Admin
429		Over 60 requests a minute; wait for Retry-After

FAQs

Can the SIEM token change anything in Onplana? No. It is read only, and it reaches the audit log endpoint and nothing else. Every other API route refuses it.

Can two SIEMs read the same workspace? Yes. Create one token for each. The rate limit counts per token, so they do not slow each other down.

How far back can the SIEM read? As far as your audit log keeps events. Set since to the start of your retention window for a first backfill, then poll forward. Retention is set under Security & Compliance > Controls, see Read audit logs.

Does a full-access token work instead? No. A token with Full access (all scopes) is refused by the audit feed, so a broad automation token can never quietly copy your audit trail.