What should administrators verify when configuring enterprise audit log streaming to an external destination such as Azure Blob, S3, or a SIEM-compatible endpoint?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Audit log streaming needs correct destination credentials, encryption, network path, and write permissions so events land continuously beyond the UI retention window—not business-hours-only or open anonymous sinks.
Full explanation below image
Full Explanation
Audit log streaming continuously sends enterprise audit events to customer-controlled storage or SIEM systems, extending retention and enabling real-time detection. Configuration must use authenticated, encrypted destinations with least-privilege write access and monitoring for stream failures. Running streams only during business hours creates evidence gaps; public unauthenticated endpoints risk tampering or interception; streaming GitHub events does not obsolete IdP or network logs. Administrators should test end-to-end ingestion, alert on stream health, document which event types are covered, and align destination retention with legal requirements. Streaming complements—not replaces—GraphQL or REST pulls for ad-hoc historical queries.