Enterprise / Log delivery
SIEM Forwarding
Stream audit activity to the security platform your team already operates, so MemorySync activity lands beside the rest of your estate.
Destinations
Pick a destination
Delivered to an HTTP Event Collector endpoint. Requires the collector URL and an HEC token.
Batching: 500 events per batch
Configure destinations in Settings → Audit. Each one can be saved in a disabled state, and there is a test action that sends a probe delivery so you can confirm the endpoint and credential before enabling it.
Behavior
How delivery behaves
- Push, in batches
- Entries are pushed to your endpoint in batches. There is nothing to poll and no agent to install.
- Retries with backoff
- A failed delivery is retried with growing intervals rather than immediately, so a brief outage on your side is absorbed.
- Disabled after repeated failure
- A destination that keeps failing is disabled rather than retrying forever, and the dashboard shows that state explicitly.
- Status is visible per destination
- Each destination reports active, error, or disabled, which is where you check first when entries stop arriving.
- Credentials are write-only in the UI
- Tokens and secrets are masked after saving; replace rather than read them.
Run the test action first and confirm entries appear in your platform before relying on the destination.
Was this page helpful?