Skip to main content
Security Exports continuously deliver normalized security_event.v1 records from Forge to your security data platform. Configure destinations in the SIEM and exports section of Settings → Integrations.

​
Destinations

Amazon S3

Write partitioned JSONL objects to S3 or compatible storage.

Splunk

Deliver events through the Splunk HTTP Event Collector.
You can create multiple destinations of the same or different types. Each destination has its own credentials, filters, detail policy, delivery cursors, replay jobs, and health state. To send selected notification events to a SOAR or custom HTTPS receiver, use the Notification Webhook under Settings → Ownership.

​
Exported events

Filters can limit delivery by category, minimum severity, source, product, identity, or endpoint. Detail policies control whether exports contain metadata, indexed summaries, retained-body references, or available inline content. Prompt and tool detail is included only when both the source and your privacy policy permit it.

​
Set up a destination

  1. Open Settings → Integrations, then select an export provider.
  2. Create a destination and enter its connection settings.
  3. Choose event filters and the permitted detail level.
  4. Send a test event and verify it at the destination.
  5. Keep the destination active to begin continuous delivery.
Creating another destination does not replace an existing one. Use separate destinations when different teams, regions, or data stores need different event scope or detail.

​
Delivery health

Each destination shows whether it is active, paused, or unhealthy, together with per-category progress, delivered and skipped event counts, recent attempts, and unresolved delivery failures. Forge retries transient delivery failures. A destination can become unhealthy when delivery cannot safely advance. Correct the receiver or credential issue, send a test event, and resume or retry delivery from the Console. Pausing stops new delivery without deleting the destination. Continuous delivery resumes from its saved cursors.

​
Replay

A replay sends matching historical events for a bounded time window and selected categories. It runs separately from continuous delivery and does not rewind the destination’s live cursors. Monitor the replay job and recent batch attempts on the destination page.