Stream logs to your SIEM

Send a record of your agents’ tool calls, and of changes to your users’ connected accounts, to your security team’s SIEM. Scalekit pushes each event to the destination as it happens, so you can alert on it and keep it with the rest of your audit logs.

• Log streaming depends on your plan. If it isn’t on yours, the Log Streaming page says so. Contact us to turn it on.
• An Admin role in the Scalekit dashboard, or a custom role that can manage log streaming.
• An account with one of these destinations:

Destination	What you need
Datadog	Your Datadog Site, such as datadoghq.com, and an API key
CrowdStrike	An Ingest URL and an Ingest token from a CrowdStrike data connector
Google SecOps	Set up with Scalekit: you grant a Scalekit service account access to your instance instead of sharing a credential. Contact us

Using a different log destination? Contact us and tell us which one.

Each environment streams separately. Set up a destination in Production to capture your users’ activity.

1. In the Scalekit dashboard, switch the product to Auth for MCP & SaaS and go to Developers > Log Streaming. Log streaming covers your AgentKit events too.

2. Select Create destination and choose the Provider.

3. Enter a Display name, such as Production SIEM, and the destination’s details from the table above.

4. Under Events to stream, keep every category checked, or uncheck the ones you don’t want. For AgentKit, keep Agent Tool Calls and Connected Accounts.

5. Make sure Stream events to this destination is on, then select Create destination.

To stop streaming without losing the setup, edit the destination and switch Stream events to this destination off.

Category	Events
Agent Tool Calls	connected_account.tool_executed, one for each tool call made on a user’s connected account. A call that fails before Scalekit finds the connected account sends no event
Connected Accounts	connected_account.created, connected_account.updated, connected_account.deleted, connected_account.status_updated, connected_account.magic_link_generated, connected_account.oauth_succeeded, connected_account.oauth_tokens_fetched, connected_account.token_refresh_succeeded, connected_account.token_refresh_failed, connected_account.tool_discovery_failed
Admin & Configuration	Changes to the environment’s configuration

Each event has the same envelope as an account event webhook: spec_version, id, type, occurred_at, environment_id, object and data.

A tool call event’s data says who called which tool, and how it went:

• The tool: tool_name, tool_provider, tool_execution_id and tool_execution_duration_ms.
• The user: connected_account_id, connected_account_identifier, connection_id and connection_name.
• The outcome: status and is_error, plus error_code and error_message when the call failed.
• The caller, when known: source, agent_id and agent_run_id.

The tool’s input and output are not included.

1. In the destination’s menu, select Test connection. Scalekit sends a test event, and the dashboard shows Connection succeeded. when the destination accepts it.
2. Search your SIEM for type:scalekit.logstream.connectivity_test to confirm it arrived.
3. Make a tool call, then open View deliveries on the destination. The connected_account.tool_executed event shows as Delivered.

If a delivery fails, Scalekit retries it. View deliveries shows each attempt with its HTTP status and when the next retry is due.