---
title: "Audit export and SIEM stream"
description: "Export the tamper-evident audit log as CSV, verify the file offline, and stream every row to your SIEM with signatures and idempotency keys."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.overlane.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit export and SIEM stream

The audit log records every member, policy, token and enterprise action with who did it, the kind of principal, the time and the result. Rows of a team form a hash chain: each row's hash covers the row before it, so an edited, removed or reordered row is found by a check that needs no network and no account.

## Export as CSV

```sh
overlane enterprise audit export --out audit.csv
overlane enterprise audit verify audit.csv
```

`export` writes two files: the CSV, with every column of every row including the two hashes, and `audit.csv.manifest.json` with the row count, the last sequence number and the head hash. `verify` re-computes the chain and compares the manifest, so the file fails if any row was changed, removed, reordered or if the newest row was dropped. It exits 1 on a failure and 0 when the file is intact.

Exporting is an audited action too: the next export contains the row that records this one. A cell that begins with `=`, `+`, `-` or `@` is prefixed with an apostrophe so a spreadsheet does not run it, and `verify` removes the prefix before checking.

## Stream to your SIEM

```sh
overlane enterprise audit stream add --url https://siem.example.com/ingest --secret-env SIEM_SECRET
```

You choose the signing secret and keep it. Overlane stores it encrypted and never shows it again; the stream target is an https address on a public host.

Each delivery is a JSON document with a batch of rows in order, sent with three headers:

- `idempotency-key`: the team, the target and the first and last sequence number of the batch. A resend of the same batch has the same key, so your SIEM can keep one copy.
- `x-overlane-timestamp`: seconds since the epoch.
- `x-overlane-signature`: the hex HMAC-SHA-256 of `timestamp.body` with your secret.

Delivery is at least once. The stream moves its cursor only after your endpoint answers with a 2xx, so a lost answer means the same batch is sent again with the same key, and a failing endpoint leaves the cursor where it was and the target marked failing until it recovers. Deliveries run every five minutes and on demand from Enterprise settings (`overlane.app/<workspace>/settings/enterprise/`).

To check what you received, keep the deliveries, drop the repeats by key, order the rows by sequence and run the chain check from the first row. A missing batch in the middle is a gap and an altered row fails; a missing newest batch shows up at the next delivery or against an export's manifest.

## Plans

Export, verify and streaming are included from the Business plan up. Verifying a file you already have needs nothing.

Source: https://docs.overlane.app/enterprise/audit-and-siem/index.mdx