Coming Soon: Real-Time Audit Streaming to Your SIEM ​

March 4, 2026 · GrantFlow Team

Compliance teams and security operations centers need privileged access events in their SIEM — not tomorrow, not after a nightly export, but in real time. GrantFlow is adding native audit event streaming so every role activation, approval decision, and account checkout flows directly into the tools you already use.

Feature in Development

This feature is currently in development. Details, functionality, and timelines described in this post may change before the final release.

The Challenge ​

GrantFlow already captures a comprehensive audit trail with typed events for every privileged access action. Today, that data lives inside GrantFlow's admin interface. Enterprise security teams using Splunk, Microsoft Sentinel, or other SIEM platforms need those events integrated into their existing alerting and correlation workflows — without manual log exports or custom polling scripts.

Three Integration Options ​

Different organizations have different infrastructure constraints. GrantFlow will offer three streaming mechanisms so you can choose the one that fits your environment:

Webhooks ​

The most common integration pattern. GrantFlow pushes batched audit events to an HTTPS endpoint you configure:

  • HMAC-SHA256 signed payloads — every delivery is cryptographically signed so your receiver can verify authenticity
  • Configurable batching — set a batch size and flush interval that balance latency against delivery efficiency
  • Automatic retry with backoff — transient failures are retried with exponential backoff. Persistently failed deliveries are tracked for investigation.
  • Event filtering — subscribe to specific event types (for example, only approval and activation events) to reduce noise

Server-Sent Events (SSE) ​

For browser-based dashboards or lightweight integrations, an SSE stream delivers audit events as they happen. GrantFlow's existing SSE infrastructure already powers real-time updates across the web application — the audit stream extends it to external consumers.

Long-Polling with Cursor ​

For SIEM connectors that prefer pull-based ingestion, a cursor-based long-polling endpoint lets you fetch events at your own pace:

  • Request a batch of events starting from a cursor position
  • The server holds the connection (up to a configurable timeout) until new events are available
  • Cursor-based pagination guarantees deterministic ordering and no event loss

Webhook Management ​

Administrators will configure and manage webhook endpoints through a new section in the admin interface:

  • Create and edit endpoints — specify the target URL, signing secret, retry policy, and event filters
  • Test delivery — send a test payload to verify connectivity and signature validation before going live
  • Monitor health — view delivery success rates, error details, and retry statistics

Security and Tenant Isolation ​

All streaming endpoints enforce the same tenant-scoped access controls as the rest of GrantFlow:

  • Webhook secrets are encrypted at rest
  • Webhook target URLs are validated to prevent internal network access (SSRF protection)
  • SSE and long-polling endpoints require admin authentication
  • Every event carries a tenantId field, and cross-tenant data is never exposed

What This Means for You ​

When audit streaming launches, you will be able to connect GrantFlow's audit trail to your existing security monitoring stack in minutes — no custom code, no scheduled exports. Whether you use webhooks for a Splunk HEC endpoint, SSE for a live dashboard, or long-polling for a custom connector, the data arrives in real time with cryptographic integrity guarantees.