> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Exports

> Send selected Forge security events to one or more external destinations.

Security Exports continuously deliver normalized `security_event.v1` records
from Forge to your security data platform. Configure destinations in the
**SIEM and exports** section of **Settings → Integrations**.

## Destinations

<CardGroup cols={2}>
  <Card title="Amazon S3" icon="database" href="/integrations/amazon-s3">
    Write partitioned JSONL objects to S3 or compatible storage.
  </Card>

  <Card title="Splunk" icon="share-2" href="/integrations/splunk">
    Deliver events through the Splunk HTTP Event Collector.
  </Card>
</CardGroup>

You can create multiple destinations of the same or different types. Each
destination has its own credentials, filters, detail policy, delivery cursors,
replay jobs, and health state.

To send selected notification events to a SOAR or custom HTTPS receiver, use
the [Notification Webhook](/integrations/notification-webhook) under
**Settings → Ownership**.

## Exported events

| Category                | Records                                   |
| ----------------------- | ----------------------------------------- |
| `agent_event`           | Agent session and event activity          |
| `governance_signal`     | Policy and governance evaluation evidence |
| `finding`               | Security findings                         |
| `org_audit`             | Organization audit records                |
| `managed_config_audit`  | Managed configuration changes and drift   |
| `agent_attribution`     | Provider-to-agent attribution results     |
| `compliance_assessment` | Compliance evaluation records             |
| `governance_workflow`   | Requests, approvals, and workflow state   |

Filters can limit delivery by category, minimum severity, source, product,
identity, or endpoint. Detail policies control whether exports contain metadata,
indexed summaries, retained-body references, or available inline content.
Prompt and tool detail is included only when both the source and your privacy
policy permit it.

## Set up a destination

1. Open **Settings → Integrations**, then select an export provider.
2. Create a destination and enter its connection settings.
3. Choose event filters and the permitted detail level.
4. Send a test event and verify it at the destination.
5. Keep the destination active to begin continuous delivery.

Creating another destination does not replace an existing one. Use separate
destinations when different teams, regions, or data stores need different event
scope or detail.

## Delivery health

Each destination shows whether it is active, paused, or unhealthy, together
with per-category progress, delivered and skipped event counts, recent
attempts, and unresolved delivery failures.

Forge retries transient delivery failures. A destination can become unhealthy
when delivery cannot safely advance. Correct the receiver or credential issue,
send a test event, and resume or retry delivery from the Console.

Pausing stops new delivery without deleting the destination. Continuous
delivery resumes from its saved cursors.

## Replay

A replay sends matching historical events for a bounded time window and
selected categories. It runs separately from continuous delivery and does not
rewind the destination's live cursors. Monitor the replay job and recent batch
attempts on the destination page.