F5 Workforce AI Security can export User Activity and Audit Event logs to external destinations. Use this to integrate with SIEM platforms, log management tools, and data warehouses. The platform supports multiple destination types:
AWS S3 buckets
Splunk HTTP Event Collector (HEC) endpoints
CrowdStrike
Generic HTTPS endpoints
The Datadog Logs API
Each destination can be configured to receive specific telemetry streams: user events, conversation data, and audit events.
Organizations typically configure telemetry destinations during initial deployment. This establishes centralized monitoring and compliance reporting. The destinations operate independently. You can send different event types to different systems, or configure multiple destinations for redundancy.
Understanding telemetry event types
Workforce AI Security generates three distinct types of telemetry data. You can turn each type on or off independently for each destination. This gives you precise control over what data flows to different systems.
User events
User events capture all user interactions with GenAI services that pass through Workforce AI Security. Each user event includes details about the request, policy decisions, risk assessments, intent classifications, and message content. User events are the most detailed telemetry stream, and they typically generate the highest volume of data.
User events include the actor (user or application), destination service, and HTTP request details. Each event also captures network information, policy violations, risk scores, detected sensitive data, intent classifications, and token usage metrics. This data lets security teams monitor usage patterns and identify policy violations. It also helps them track sensitive data exposure and audit GenAI interactions across the organization.
Conversation data
Conversation data provides supplementary context about multi-turn conversations between users and GenAI services. This telemetry stream captures conversation-level metadata and the relationships between individual message exchanges. It helps organizations understand how users interact with GenAI services over extended sessions. This is more useful than viewing each message as an isolated event.
Audit events
Audit events record administrative actions and configuration changes within the Workforce AI Security platform. These events track activities such as policy modifications, user provisioning, connector configuration changes, and administrative access. Audit events are essential for compliance reporting and security investigations. They provide a complete audit trail of who changed what, and when.
Organizations often send audit events to different destinations than user events. Audit logs typically integrate with different downstream systems. For example, user events might flow to a security information and event management (SIEM) platform for threat detection. Audit events might go to a governance, risk, and compliance (GRC) system instead, for compliance reporting.
Understanding the file structure and format
Workforce AI Security writes telemetry data in a structured format designed for efficient processing and long-term storage. Understanding the file structure, naming conventions, and content format helps organizations integrate with downstream analytics tools.
For file structure, naming conventions, compression format, and the complete telemetry schema, see Telemetry schema and format.
Accessing the telemetry configuration
You configure telemetry destinations through the Workforce AI Security admin interface. The telemetry configuration page displays all configured destinations and their current status. You can manage multiple destinations from this single location.
To access telemetry configuration:
Click Telemetry in the CONFIGURE section
The telemetry page displays a table with all configured destinations. Each destination entry shows the destination name and type. It also shows which event types are enabled, along with activation status and current status. From this page, you can add new destinations, edit existing configurations, or delete destinations.
Configuring AWS S3 bucket destinations
AWS S3 bucket destinations use role assumption, through an AWS connector, to write telemetry files directly to an S3 bucket. This removes the need for long-term credentials. It gives you a secure, scalable way to store telemetry data. Use S3 destinations to retain telemetry data for long-term analysis or compliance archiving. You can also use them to integrate with AWS-native analytics tools.
The S3 integration writes compressed NDJSON files to the bucket every 15 minutes. Files are organized in a hierarchical directory structure based on UTC timestamps. This structure makes it easy to locate and process events from specific time periods.
Prerequisites for AWS S3 destinations
Before configuring an S3 destination in Workforce AI Security, complete the following prerequisites in AWS:
Create or identify an S3 bucket where telemetry files will be stored
Note the AWS region where the S3 bucket exists
Configure an AWS connector in Workforce AI Security using CloudFormation to establish role assumption permissions
The AWS connector uses a CloudFormation template that creates an IAM role with permissions to write to S3 buckets. Workforce AI Security assumes this role when writing telemetry files. This gives you secure access without long-term AWS credentials.
Setting up the AWS connector
Configure an AWS connector before you create S3 telemetry destinations. The connector establishes the trust relationship and permissions that let Workforce AI Security access AWS resources.
To set up an AWS connector:
Click Connectors in the CONFIGURE section
Click ADD CONNECTOR
Enter a descriptive name for the connector (for example, "AWS Telemetry Connector")
Select AWS from the connector type dropdown
Click SAVE
Follow the CloudFormation deployment instructions that appear. These include a unique CloudFormation template URL for your organization
In the AWS console, create a new CloudFormation stack using the provided template URL
Complete the CloudFormation stack creation. Note the outputs, including the IAM role ARN
Return to the Workforce AI Security connector configuration and enter the IAM role ARN
Click SAVE CHANGES
The CloudFormation template creates an IAM role with a trust policy that lets Workforce AI Security assume the role. The role includes permissions to create and write to S3 buckets. Once you configure the connector and verify the role, you can use it for multiple S3 telemetry destinations.
For the CloudFormation template and role configuration, see the Updating Access Permissions for Workforce AI Security's CloudFormation Stack documentation.
Obtaining AWS S3 bucket information
Gather the following information from AWS before configuring the S3 destination in Workforce AI Security:
S3 Bucket Name: The exact name of the S3 bucket where telemetry files will be written. The bucket must already exist in AWS. Workforce AI Security does not create buckets automatically.
AWS Region: The AWS region code where the S3 bucket is located (for example,
us-east-1,us-west-2,eu-west-1). This must match the region where the bucket exists.S3 Key Prefix (Optional): A directory path prefix added to all telemetry file paths. For example, if the key prefix is
workforce-ai-security/production/, all files are written under that path. This helps when multiple systems write to the same bucket. It also helps when you apply bucket lifecycle policies to specific prefixes.
To find this information in the AWS console:
Open the AWS S3 console
Locate the destination bucket in the bucket list
Click on the bucket name to view its properties
Note the bucket name exactly as it appears
Note the AWS region shown in the bucket properties
Creating an S3 telemetry destination
Configure the AWS connector and gather the S3 bucket information first. Then create the telemetry destination in Workforce AI Security.
To create an S3 destination:
Click Telemetry in the CONFIGURE section
Click ADD DESTINATION
Enter a descriptive name for the destination in the Name field
Select AWS S3 Bucket from the Destination Type dropdown
Select the AWS connector from the Connector dropdown
Select the AWS region from the AWS Region dropdown
Enter the S3 bucket name in the AWS S3 Bucket Name field
(Optional) Enter a key prefix in the AWS S3 Key Prefix field, if files should go to a specific path within the bucket
Review the destination URLs shown. These display the exact S3 paths where user events and audit events will be written
Turn on the telemetry source activation options you need: User Events, Conversation Data, and Audit Events
Toggle Enabled to activate the destination
Click SAVE
After saving, Workforce AI Security validates the connector and bucket permissions. If validation succeeds, the destination becomes active. It starts writing telemetry files to the S3 bucket every 15 minutes. If validation fails, the destination status shows an error. Verify that the connector is configured correctly, and that the S3 bucket name and region are accurate.
The destination URLs shown during configuration display the full S3 paths where files will be written. User events are written to a path that includes the version number and a date hierarchy (for example, s3://bucket-name/surepath-ai/user-events/v2/YYYY/MM/DD/HH/). Audit events use a similar structure under the audit-events path.
Configuring Splunk HEC Index destinations
Splunk HTTP Event Collector (HEC) destinations send telemetry events directly to Splunk indexes in real time. This gives immediate visibility into GenAI usage and security events, in Splunk dashboards, alerts, and analytics. Use Splunk HEC destinations when you have existing Splunk deployments. This lets you correlate GenAI telemetry with other security and operational data.
The HEC integration sends events as soon as they're generated. This provides near-real-time data delivery to Splunk. Events are formatted as JSON and include all relevant metadata, so they're immediately searchable and compatible with Splunk's analytics.
Prerequisites for Splunk HEC destinations
Before configuring a Splunk HEC destination in Workforce AI Security, complete the following prerequisites in Splunk:
Have admin access to Splunk Enterprise or Splunk Cloud Platform
Identify or create indexes where user events and audit events will be stored
Enable HTTP Event Collector on the Splunk deployment
Create an HEC token with permissions to write to the target indexes
Note the HEC URL endpoint for the Splunk deployment
Obtaining Splunk HEC configuration information
Gather the following information from Splunk before configuring the HEC destination in Workforce AI Security.
Enable HTTP Event Collector
Turn on HTTP Event Collector on the Splunk deployment before tokens can receive events. On Splunk Cloud Platform, HEC is on by default. On Splunk Enterprise, you must turn it on manually.
To enable HEC on Splunk Enterprise:
Log in to Splunk Web with admin credentials
Click Settings > Data inputs
Click HTTP Event Collector
Click Global Settings
Click Enabled to enable HEC
(Optional) Configure the HTTP port if different from the default (8088)
(Optional) Enable SSL if the deployment should only accept HTTPS connections
Click Save
Create an HEC token in Splunk
HEC tokens provide authentication for external systems sending events to Splunk. Each token is associated with specific indexes and source type configurations.
To create an HEC token on Splunk Enterprise:
Click Settings > Add Data
Click Monitor
Click HTTP Event Collector
In the Name field, enter a descriptive name for the token (for example, "Workforce AI Security Telemetry")
(Optional) In the Source name override field, enter a source name to assign to all events (for example, "workforce-ai-security")
(Optional) In the Description field, enter a description of the token's purpose
(Optional) Turn on Indexer acknowledgment if you need guaranteed delivery
Click Next
In the Source type dropdown, select Automatic or choose a specific source type
In the Index section, select the indexes where events should be stored
Click Review
Review all settings and click Submit
Copy the token value Splunk displays. Save it securely for the Workforce AI Security configuration
To create an HEC token on Splunk Cloud Platform:
Click Settings > Add Data
Click Monitor
Click HTTP Event Collector
In the Name field, enter a descriptive name for the token
(Optional) Enter a source name override and description
(Optional) Turn on Indexer acknowledgment if it's supported and you need it
Click Next
Select or confirm the index where events should be stored (the index must already exist)
Click Review
Review all settings and click Submit
Copy the token value and save it securely
Click Track deployment progress to monitor token distribution across the Splunk Cloud deployment
Wait for the status to show "Done" before using the token
The token value is a 32-character globally unique identifier (GUID). It looks similar to B5A79AAD-D822-46CC-80D1-819F80D7BFB0. Enter this value in the Workforce AI Security configuration exactly as displayed. It's case-insensitive.
Determine the HEC URL
The HEC URL is the endpoint where Workforce AI Security sends events. The URL format depends on whether the Splunk deployment is on-premises (Splunk Enterprise) or cloud-based (Splunk Cloud Platform).
For Splunk Enterprise, the HEC URL typically follows this format:
https://<splunk-hostname>:8088/services/collector
Where <splunk-hostname> is the hostname or IP address of the Splunk server or load balancer. 8088 is the default HEC port, which may differ if customized during HEC configuration.
For Splunk Cloud Platform, the HEC URL is provided by Splunk and typically follows this format:
https://http-inputs-<deployment-name>.splunkcloud.com:443/services/collector
Where <deployment-name> is the unique identifier for the Splunk Cloud deployment.
To find the exact HEC URL:
For Splunk Enterprise: Check the HEC global settings under Settings > Data inputs > HTTP Event Collector > Global Settings to confirm the port number. Then construct the URL using the server hostname
For Splunk Cloud Platform: Consult Splunk Cloud documentation or support to obtain the correct HEC endpoint URL for the deployment
Identify index names
Workforce AI Security requires separate indexes for user events and audit events. You can use existing indexes, or create new ones specifically for Workforce AI Security telemetry.
To view existing indexes in Splunk:
Click Settings > Indexes
Review the list of available indexes
Note the exact names of the indexes where user events and audit events should be stored
To create a new index in Splunk Enterprise:
Click Settings > Indexes
Click New Index
Enter an Index Name (for example, "workforce_ai_security_user_events" or "workforce_ai_security_audit_events")
Configure retention policies, size limits, and other settings as appropriate for organizational requirements
Click Save
For Splunk Cloud Platform, submit a support request to create new indexes. Index creation isn't available through the Splunk Web interface on that platform.
Separate indexes for user events and audit events simplify data management. They let you apply different retention policies and control access permissions independently. User events typically generate much higher volumes than audit events, so separating them supports independent capacity planning.
Create a source identifier
The source identifier is a text string that Splunk assigns to all events received through the HEC token. This identifier helps distinguish Workforce AI Security events from other data sources in Splunk indexes.
Organizations can choose any meaningful source identifier. Common patterns include:
workforce-ai-securityworkforce-ai-security:telemetrygenai:workforce-ai-security
Set the source identifier when you create the token, in the HEC token settings, under the Source name override field. If you don't specify one, Splunk uses a default source value based on the client connection.
Creating a Splunk HEC telemetry destination
Once you gather all the required information from Splunk, create the HEC telemetry destination in Workforce AI Security.
To create a Splunk HEC destination:
Click Telemetry in the CONFIGURE section
Click ADD DESTINATION
Enter a descriptive name for the destination in the Name field
Select Splunk HEC Index from the Destination Type dropdown
Enter the HEC URL in the HEC URL field
Enter the source identifier in the Source Identifier field
Enter the HEC token value in the HEC Token field
Enter the index name for user events in the User Event Index field
Enter the index name for audit events in the Audit Event Index field
(Optional) Turn on Allow self-signed certificates if the Splunk deployment uses self-signed SSL certificates
Turn on the telemetry source activation options you need: User Events, Conversation Data, and Audit Events
Toggle Enabled to activate the destination
Click SAVE
After saving, Workforce AI Security validates the connection to the Splunk HEC endpoint. It does this by attempting to send a test event. If validation succeeds, the destination becomes active and starts sending telemetry events to Splunk in real time. If validation fails, the destination status shows an error. Verify that the HEC URL, token, and index names are correct.
Only turn on Allow self-signed certificates for Splunk deployments that use self-signed SSL certificates, such as development or test environments. Production Splunk deployments should use certificates signed by a trusted certificate authority. Leave this option off for those deployments.
Configuring CrowdStrike destinations
CrowdStrike destinations send telemetry events to a CrowdStrike Falcon Next-Gen SIEM data connector using an HTTP Event Collector (HEC)-compatible ingest endpoint. Use CrowdStrike destinations when you run Falcon Next-Gen SIEM. This lets you correlate GenAI telemetry with other security event data in that platform.
The CrowdStrike integration uses the same HEC-style configuration as a Splunk HEC destination. It needs an ingest URL, a token, and an index for each event type.
Prerequisites for CrowdStrike destinations
Before configuring a CrowdStrike destination in Workforce AI Security, complete the following prerequisites in the CrowdStrike Falcon console:
Have admin access to the Falcon console with Next-Gen SIEM enabled
Go to Next-Gen SIEM > Data Ingestion > Data Connectors, then Add Data Connector and select an HEC/HTTP Event data connector
Note the ingest URL that CrowdStrike displays for the new connector
Save the API key CrowdStrike generates for the connector. CrowdStrike displays this value only once, at creation time
Obtaining CrowdStrike configuration information
Gather the following information from the CrowdStrike Falcon console before configuring the destination in Workforce AI Security:
HEC URL: The ingest URL CrowdStrike displays when creating the data connector, in the form
https://<instance_id>.ingest.<region>.crowdstrike.comHEC Token: The API key CrowdStrike generates for the data connector. Save this value when CrowdStrike first displays it; the console does not show it again
Source Identifier: A text string Workforce AI Security sends with each event to identify Workforce AI Security as the source, using the standard HEC
sourcefieldUser Event Index and Audit Event Index (Optional): Index names to route user events and audit events to, if the connector requires them
Creating a CrowdStrike telemetry destination
Once you configure the CrowdStrike data connector and save its ingest URL and token, create the telemetry destination in Workforce AI Security.
To create a CrowdStrike destination:
Click Telemetry in the CONFIGURE section
Click ADD DESTINATION
Enter a descriptive name for the destination in the Name field
Select CrowdStrike from the Destination Type dropdown
Enter the ingest URL in the HEC URL field
Enter a source identifier in the Source Identifier field
Enter the API key in the HEC Token field
(Optional) Enter index names in the User Event Index and Audit Event Index fields
(Optional) Toggle Allow self-signed certificates if the connector endpoint uses self-signed SSL certificates
Enable the desired telemetry source activation options by toggling User Events, Conversation Data, and Audit Events as needed
Toggle Enabled to activate the destination
Click SAVE
After saving, Workforce AI Security tries to send a test event to the CrowdStrike endpoint, to validate the connection. If validation fails, the destination status shows an error. Verify that the HEC URL and token match the values CrowdStrike issued for the data connector.
Configuring HTTPS endpoint destinations
HTTPS endpoint destinations send telemetry events to any HTTPS endpoint. This is a generic integration method. Use it to connect Workforce AI Security telemetry to custom applications, third-party SIEM platforms, log aggregation services, or data warehouses that accept data over HTTP.
The HTTPS endpoint integration sends events in real time, as JSON payloads, to the configured URL. Each event goes out as a separate HTTP POST request, with authentication headers as specified in the destination configuration.
Understanding HTTPS endpoint requirements
The destination endpoint must meet the following requirements to receive Workforce AI Security telemetry:
Accept HTTP POST requests with JSON payloads
Support HTTPS (HTTP is not supported)
Provide a stable endpoint URL that does not change
Set up authentication using either Bearer tokens or custom header-based authentication
Return HTTP 200 status codes for successful event delivery
Handle individual events (Workforce AI Security sends one event per HTTP request)
Make sure a custom HTTPS endpoint can handle the expected volume of telemetry events. User events typically generate the highest volume. Event rates vary based on your organization's GenAI usage patterns.
Obtaining endpoint configuration information
Before configuring an HTTPS endpoint destination, gather the following information from the destination system:
Endpoint URL: The complete HTTPS URL where telemetry events should be sent (for example,
https://telemetry.example.com/ingest/workforce-ai-security)Authentication Type: The authentication method required by the endpoint (Bearer token or custom header)
Authentication Header Name: For custom authentication, the exact name of the HTTP header that contains the authentication token (for example,
X-API-Key,Authorization,X-Auth-Token)Token Value: The authentication token or API key required to authenticate requests to the endpoint
Creating an HTTPS endpoint telemetry destination
Once you gather the endpoint information, create the HTTPS endpoint destination in Workforce AI Security.
To create an HTTPS endpoint destination with Bearer authentication:
Click Telemetry in the CONFIGURE section
Click ADD DESTINATION
Enter a descriptive name for the destination in the Name field
Select HTTPS Endpoint from the Destination Type dropdown
Enter the complete endpoint URL in the Endpoint URL field
Select Bearer from the Authentication Type dropdown
Verify that the Authentication Header Name field shows Authorization
Enter the bearer token value in the Bearer Token field
(Optional) Turn on Allow self-signed certificates if the endpoint uses self-signed SSL certificates
Turn on the telemetry source activation options you need: User Events, Conversation Data, and Audit Events
Toggle Enabled to activate the destination
Click SAVE
To create an HTTPS endpoint destination with custom authentication:
Click Telemetry in the CONFIGURE section
Click ADD DESTINATION
Enter a descriptive name for the destination in the Name field
Select HTTPS Endpoint from the Destination Type dropdown
Enter the complete endpoint URL in the Endpoint URL field
Select Custom from the Authentication Type dropdown
Enter the authentication header name in the Authentication Header Name field
Enter the token value in the Custom Token field
(Optional) Turn on Allow self-signed certificates if the endpoint uses self-signed SSL certificates
Turn on the telemetry source activation options you need: User Events, Conversation Data, and Audit Events
Toggle Enabled to activate the destination
Click SAVE
After saving, Workforce AI Security validates the connection to the HTTPS endpoint. It does this by attempting to send a test event. If validation succeeds, the destination becomes active and starts sending telemetry events in real time. If validation fails, the destination status shows an error. Verify that the endpoint URL, authentication type, and token are correct.
Bearer authentication is the most common authentication method for REST APIs. It follows the standard HTTP Bearer authentication scheme. When you select Bearer authentication, Workforce AI Security sends requests with an Authorization header containing the value Bearer <token>. Custom authentication lets you specify any header name and token format your endpoint requires.
Configuring Datadog Logs API destinations
Datadog Logs API destinations send telemetry events directly to Datadog using its Logs ingestion API. Organizations use Datadog destinations when they already monitor infrastructure and applications in Datadog and want GenAI telemetry alongside that data.
Prerequisites for Datadog Logs API destinations
Before configuring a Datadog destination in Workforce AI Security, complete the following prerequisites in Datadog:
Have admin access to the Datadog organization
Know which Datadog site the organization uses (for example, US1, US3, US5, EU1, or AP1). This is set when the organization first signs up with Datadog and does not change
Go to Organization Settings > API Keys, then create a new key or identify an existing one to use for telemetry ingestion
Obtaining Datadog configuration information
Gather the following information from Datadog before configuring the destination in Workforce AI Security:
Datadog Site: The Datadog site the organization's account uses. This determines which regional endpoint receives the telemetry events
API Key: The API key from Organization Settings > API Keys. Datadog displays the full key value only when it's created
Source, Tags, Service, and Hostname (Optional): Metadata Workforce AI Security attaches to every event, matching Datadog's own
ddsource,ddtags,service, andhostnamelog attributes. Use these to filter and correlate Workforce AI Security events with other data in Datadog. Separate multiple Tags with spaces
Creating a Datadog Logs API telemetry destination
Confirm the Datadog site and API key first. Then create the telemetry destination in Workforce AI Security.
To create a Datadog Logs API destination:
Click Telemetry in the CONFIGURE section
Click ADD DESTINATION
Enter a descriptive name for the destination in the Name field
Select Datadog Logs API from the Destination Type dropdown
Select the organization's site from the Datadog Site dropdown
Enter the API key in the API Key field
(Optional) Enter values for Source, Tags, Service, and Hostname under Metadata
Enable the desired telemetry source activation options by toggling User Events, Conversation Data, and Audit Events as needed
Toggle Enabled to activate the destination
Click SAVE
After saving, Workforce AI Security tries to send a test event to Datadog, to validate the connection. If validation fails, the destination status shows an error. Verify that the selected site matches your actual Datadog account, and that the API key is valid.
Managing telemetry destinations
After creating telemetry destinations, you can modify configurations and turn destinations on or off. You can also monitor delivery status through the telemetry configuration interface.
Edit telemetry destinations
To modify an existing telemetry destination:
Click Telemetry in the CONFIGURE section
Locate the destination in the destination list
Click the destination name, or click the menu icon (three dots) and select Edit
Modify the configuration settings you need to change
Click SAVE
Changes to telemetry destinations take effect immediately. If a destination is currently enabled and delivering events, modifying it may briefly interrupt event delivery. This happens while Workforce AI Security validates the new settings.
Turn destinations on and off
You can temporarily turn off a destination without deleting its configuration. This is useful when troubleshooting destination issues, performing maintenance on the receiving system, or reducing telemetry volume for a while.
To turn off a destination:
Click Telemetry in the CONFIGURE section
Locate the destination in the destination list
Toggle the Enabled switch to off
To turn on a destination:
Click Telemetry in the CONFIGURE section
Locate the destination in the destination list
Toggle the Enabled switch to on
When a destination is off, Workforce AI Security stops sending events to it immediately. Events generated while a destination is off are not queued or retried. They are not sent to that destination. Other destinations keep receiving events normally.
Delete telemetry destinations
Deleting a telemetry destination permanently removes the configuration and stops all event delivery to that destination. You can't undo this action.
To delete a destination:
Click Telemetry in the CONFIGURE section
Locate the destination in the destination list
Click the menu icon (three dots) and select Delete
Confirm the deletion when prompted
Turn off a destination first, and confirm you no longer need it before deleting it. Once deleted, you must recreate the destination configuration entirely if you need to restore it.
Monitor destination status
The telemetry destination list displays the current status of each configured destination. Status indicators help you identify destinations that are operating normally versus those with configuration issues or delivery failures.
Common status indicators include:
Active: The destination is enabled and successfully delivering events
Disabled: The destination is configured but currently turned off
Error: The destination encountered a configuration or delivery error
When a destination shows an error status, click on the destination to view detailed error information. Common error conditions include invalid credentials, network connectivity issues, incorrect endpoint URLs, or insufficient permissions to write to the target system.
Telemetry data format and schema
All telemetry destinations receive events in a structured JSON format. The specific format and schema version depend on the destination type and when you created the destination.
Workforce AI Security uses schema version 2 for all new telemetry destinations. This version provides an event structure with detailed policy decision information, risk assessments, intent classifications, and message content.
For the telemetry schema, including all available JSON fields, data types, descriptions, and format examples, see Telemetry schema and format.
Best practices for telemetry configuration
Start with a single destination
Start by configuring a single destination for user events. This lets you validate that events are flowing correctly, and understand the data volume and format. Confirm that downstream systems can process the events before expanding to multiple destinations or adding audit events.
Use separate destinations for different event types
Consider separate destinations for user events and audit events when they need to flow to different systems, or need different retention policies. For example, send user events to a SIEM platform for security monitoring. Send audit events to a compliance logging system instead.
Configure appropriate retention policies
For S3 destinations, set up S3 lifecycle policies to automatically archive or delete old telemetry files, based on your data retention requirements. For Splunk destinations, configure index retention policies that fit your compliance requirements and storage capacity.
Use descriptive naming
Name telemetry destinations descriptively, to indicate the destination system and purpose (for example, "Splunk Production SIEM", "AWS Compliance Archive", "QRadar Security Analytics"). This helps you identify destinations quickly, and understand their purpose when reviewing configurations.