Audit Log Drains Reference

Audit Log Drains forward team activity events to external endpoints for storage, compliance review, and analysis. Vercel sends Audit Log events to custom HTTP endpoints over HTTPS when team activity creates audit log records.

Audit Log Drains apply to the whole team. Filtering, sampling, and project selection are not available for Audit Log Drains.

Audit Log events include the events shown in the Activity Log and additional audit metadata.

The following table describes the possible fields sent via Audit Log Drains:

*Required when actor is present.

**Required for each object in the via array.

Vercel supports the following formats for Audit Log Drains. You can configure the format when configuring the Drain destination.

Audit Log Drains can also write events directly to Amazon S3. See Drain Audit Logs to S3 for AWS IAM setup, file structure, and destination fields.

To send Audit Logs to Splunk over the HTTP Event Collector, see Drain Audit Logs to Splunk.

To send Audit Logs to Datadog, see Drain Audit Logs to Datadog for site selection and destination fields.

To send Audit Logs to Panther, see Drain Audit Logs to Panther for source and destination setup.

Vercel sends Audit Log data as JSON arrays containing event objects:

[
  {
    "schema": "vercel.audit_log.v1",
    "id": "uev_O0Sn1S6VHTDuKJ6sNs3hLIEy",
    "teamId": "team_123",
    "projectId": "prj_123",
    "action": "drain-created",
    "timestamp": 1779444000123,
    "actor": {
      "type": "user",
      "id": "user_123",
      "name": "Test User",
      "email": "test@example.com"
    },
    "via": [
      {
        "type": "app",
        "id": "app_123",
        "name": "Test App"
      }
    ],
    "requestId": "req_123",
    "payload": {
      "drainUrl": "https://example.com"
    }
  },
  {
    "schema": "vercel.audit_log.v1",
    "id": "uev_O0Sn1S6VHTDuKJ6sNs3hLIEz",
    "teamId": "team_123",
    "action": "team-updated",
    "timestamp": 1779444000456,
    "actor": {
      "type": "system",
      "id": "system",
      "name": "System"
    },
    "payload": {}
  }
]

Vercel sends Audit Log data as newline-delimited JSON objects:

{"schema":"vercel.audit_log.v1","id":"uev_O0Sn1S6VHTDuKJ6sNs3hLIEy","teamId":"team_123","projectId":"prj_123","action":"drain-created","timestamp":1779444000123,"actor":{"type":"user","id":"user_123","name":"Test User","email":"test@example.com"},"via":[{"type":"app","id":"app_123","name":"Test App"}],"requestId":"req_123","payload":{"drainUrl":"https://example.com"}}
{"schema":"vercel.audit_log.v1","id":"uev_O0Sn1S6VHTDuKJ6sNs3hLIEz","teamId":"team_123","action":"team-updated","timestamp":1779444000456,"actor":{"type":"system","id":"system","name":"System"},"payload":{}}

When the destination is Splunk, Vercel wraps each event in the Splunk HTTP Event Collector event envelope. The time field is the event time in epoch seconds with millisecond precision, and the event field contains the audit log event. Vercel tags each envelope with the vercel source and the vercel:audit_log source type:

{"time":1779444000.123,"source":"vercel","sourcetype":"vercel:audit_log","event":{"schema":"vercel.audit_log.v1","id":"uev_O0Sn1S6VHTDuKJ6sNs3hLIEy","teamId":"team_123","action":"drain-created","timestamp":1779444000123,"actor":{"type":"user","id":"user_123","name":"Test User"},"payload":{"drainUrl":"https://example.com"}}}

See Drain Audit Logs to Splunk for HEC setup and destination fields.

When the destination is Datadog, Vercel sends events as JSON to the Datadog Logs API for your selected Datadog site. Each event contains the audit log fields at the top level, tagged with ddsource set to vercel and service set to audit-logs so you can filter and route Vercel audit log events in Datadog.

See Drain Audit Logs to Datadog for API key setup and destination fields.

When the destination is Panther, Vercel sends the standard Audit Log Drain JSON format to Panther's built-in Vercel source. Panther destinations use the Audit Log fields from the schema above.

Use the HTTP Source URL and generated Bearer token that Panther provides when you create the Vercel source. Vercel sends the token in the Authorization header using the Bearer <token> format.

See Drain Audit Logs to Panther for source setup and destination fields.

The action value identifies the team activity that created the audit log event. For the full list of action values, see Events logged.

The payload object contains action-specific metadata. Its fields depend on the action value.

For more information on Audit Log Drains and how to use them, check out the following resources:

• Drains overview
• Configure Drains
• Drain Audit Logs to S3
• Drain Audit Logs to Splunk
• Drain Audit Logs to Datadog
• Drain Audit Logs to Panther
• Audit Logs
• Migrating from Custom SIEM Log Streaming