Skip to main content
Summand’s audit trail covers two surfaces: Both are retained for 6+ years to meet HIPAA requirements, and both are queryable.

​
Viewing identity audit logs

From Settings → Organization → Audit Logs → Configure in Summand. The link opens a one-time WorkOS Admin Portal session pointed at the audit log viewer. Every event has:
  • Timestamp (UTC)
  • Actor (user ID, email, IP address, user agent)
  • Event type (user.signed_in, connection.activated, sso.session_created, etc.)
  • Result (success / failure)
  • Context (which org, which connection, which target)
You can filter by date range, event type, actor, and result.

​
Streaming to your SIEM

For real-time monitoring and longer retention, forward events to your SIEM via Log Streams:
1

Open Log Streams

Settings → Organization → Log Streams → Configure.
2

Pick a destination

Datadog, Splunk, AWS S3, or generic HTTPS webhook are supported.
3

Configure the destination

Provide the API key / endpoint URL the destination requires. The portal validates the connection before saving.
4

Verify events arrive

Sign in or trigger a test event; you should see it in your SIEM within 30 seconds.
A common pattern: route events to S3 for long-term archive and to Datadog for real-time alerting. Multiple log streams can run in parallel.

​
What to alert on

Suggested alerting rules:
  • Spike in failed logins (user.signed_in_failed) from a single IP
  • Multiple SSO connection changes (connection.activated, connection.deactivated) outside change windows
  • Unexpected role escalations (organization_membership.role_changed to admin or owner)
  • MFA factor deletions (authentication_factor.deleted)
  • SCIM provisioning failures (directory.sync_failed)

​
Application-level audit (Summand-side)

In addition to identity events, Summand logs application events to CloudWatch: Enterprise customers can request these forwarded to their SIEM via the same Log Streams plumbing — contact support to enable.

​
Retention

Six-year retention satisfies HIPAA’s audit requirement. ISO 27001 and SOC 2 audits accept the same retention period. For litigation hold or regulatory retrieval requests:
  • The WorkOS audit log can be exported via the portal in CSV or JSON.
  • CloudWatch logs can be exported via your AWS account if Enterprise log forwarding is set up; otherwise, contact Summand support and we’ll export for you within 5 business days.