> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns.
>
> **Recommended** (the `-y` flags skip prompts, so the command runs without an interactive terminal):
> ```bash
> npx -y @scalekit-inc/cli setup -y
> ```
>
> Global:
> ```bash
> npm install -g @scalekit-inc/cli
> scalekit setup -y
> ```
>
> Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for other Agent Skills-compatible agents in `~/.agents/skills`.
> Skills: integrate-agentkit, implement-saaskit, add-mcp-oauth, implement-sso, implement-scim.
> [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/)

---

# Stream logs to your SIEM

Stream AgentKit tool calls, connected account changes and other events to Datadog, CrowdStrike or Google SecOps, and check what was delivered.
Send a record of your agents' tool calls, and of changes to your users' connected accounts, to your security team's SIEM. Scalekit pushes each event to the destination as it happens, so you can alert on it and keep it with the rest of your audit logs.

## Before you start

- Log streaming depends on your plan. If it isn't on yours, the **Log Streaming** page says so. [Contact us](/support/contact-us/) to turn it on.
- An Admin role in the Scalekit dashboard, or a [custom role](/agentkit/team-members/#create-a-custom-role) that can manage log streaming.
- An account with one of these destinations:

| Destination | What you need |
|---|---|
| Datadog | Your Datadog **Site**, such as `datadoghq.com`, and an **API key** |
| CrowdStrike | An **Ingest URL** and an **Ingest token** from a CrowdStrike data connector |
| Google SecOps | Set up with Scalekit: you grant a Scalekit service account access to your instance instead of sharing a credential. [Contact us](/support/contact-us/) |

Using a different log destination? [Contact us](/support/contact-us/) and tell us which one.

Each environment streams separately. Set up a destination in Production to capture your users' activity.

## Create a destination

1. In the Scalekit dashboard, switch the product to **Auth for MCP & SaaS** and go to **Developers** > **Log Streaming**. Log streaming covers your AgentKit events too.

2. Select **Create destination** and choose the **Provider**.

3. Enter a **Display name**, such as `Production SIEM`, and the destination's details from the table above.

4. Under **Events to stream**, keep every category checked, or uncheck the ones you don't want. For AgentKit, keep **Agent Tool Calls** and **Connected Accounts**.

5. Make sure **Stream events to this destination** is on, then select **Create destination**.

To stop streaming without losing the setup, edit the destination and switch **Stream events to this destination** off.

## What AgentKit streams

| Category | Events |
|---|---|
| **Agent Tool Calls** | `connected_account.tool_executed`, one for each tool call made on a user's connected account. A call that fails before Scalekit finds the connected account sends no event |
| **Connected Accounts** | `connected_account.created`, `connected_account.updated`, `connected_account.deleted`, `connected_account.status_updated`, `connected_account.magic_link_generated`, `connected_account.oauth_succeeded`, `connected_account.oauth_tokens_fetched`, `connected_account.token_refresh_succeeded`, `connected_account.token_refresh_failed`, `connected_account.tool_discovery_failed` |
| **Admin & Configuration** | Changes to the environment's configuration |

Each event has the same envelope as an [account event webhook](/agentkit/account-events/): `spec_version`, `id`, `type`, `occurred_at`, `environment_id`, `object` and `data`.

A tool call event's `data` says who called which tool, and how it went:

- **The tool:** `tool_name`, `tool_provider`, `tool_execution_id` and `tool_execution_duration_ms`.
- **The user:** `connected_account_id`, `connected_account_identifier`, `connection_id` and `connection_name`.
- **The outcome:** `status` and `is_error`, plus `error_code` and `error_message` when the call failed.
- **The caller,** when known: `source`, `agent_id` and `agent_run_id`.

The tool's input and output are not included.

> note
>
> An event can be delivered more than once. Use the event's `id` to drop duplicates in your SIEM.

## Check it worked

1. In the destination's menu, select **Test connection**. Scalekit sends a test event, and the dashboard shows **Connection succeeded.** when the destination accepts it.
2. Search your SIEM for `type:scalekit.logstream.connectivity_test` to confirm it arrived.
3. Make a tool call, then open **View deliveries** on the destination. The `connected_account.tool_executed` event shows as **Delivered**.

If a delivery fails, Scalekit retries it. **View deliveries** shows each attempt with its HTTP status and when the next retry is due.

## Next

  - [Enterprise features](/agentkit/enterprise-features/): SSO, SCIM, custom roles and your own encryption key.
  - [Security and compliance](/agentkit/security/): What Scalekit protects, and what your app is responsible for.


---

## More Scalekit documentation

| Resource | What it contains | When to use it |
|----------|-----------------|----------------|
| [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content |
| [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas |
| [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |