Security alerts and audit log streaming

Die Hilfeartikel sind auf Englisch verfasst. Der Assistent in der App beantwortet Fragen in Ihrer Sprache.

Security alerts

Every owner gets an email when something sensitive happens in the workspace:

someone joins, is invited, or is removed, a member's role changes, or an owner changes which clients a member can see,
an authenticator is removed, two-step verification is reset for someone, a recovery code is used, or new recovery codes are created,
the team two-step requirement is turned off,
a connection is added, changed or removed (new credentials included),
SeatReaper support is given access, opens the workspace, or changes an owner,
audit log streaming is set up, turned off, or paused after failures,
an owner downloads all workspace data, or asks to close the workspace or keeps it.

Alerts go out within seconds of the change, several at once in one email. They list who did what and when, in UTC. Each owner can turn them off for themselves under Settings > Security > Security alerts; they are on unless you turn them off. The latest alerts are listed there too.

If you did not expect an alert, open the audit log, check the people on your team, and use Sign out everywhere on the Security page.

Audit log streaming

An owner can send every audit log entry to a SIEM or log platform (Microsoft Sentinel, Splunk, Datadog, a webhook relay) as it happens.

Open Settings > Security > Audit log streaming.
Enter your endpoint's https address and choose Start streaming.
Copy the signing secret shown. It is shown once; saving the address again creates a new one.

Streaming starts with entries written after you save, beginning with the change itself, so the first delivery doubles as a test. For older entries, use Download CSV on the same page.

What is sent

Each delivery is an HTTPS POST of JSON, in order, up to 200 entries at a time:

{
  "workspace_id": "your workspace ID",
  "sent_at": "2026-10-20T12:00:00.000Z",
  "events": [
    {
      "id": 4182,
      "at": "2026-10-20T11:59:58.120Z",
      "actor_type": "user",
      "actor_email": "jo@yourmsp.com",
      "action": "connector.connected",
      "entity_type": "msp_connectors",
      "entity_id": "crowdstrike",
      "details": { "kind": "crowdstrike" }
    }
  ]
}

The id only increases, so you can drop any entry you have already stored.

Checking the signature

Two headers come with each delivery:

X-SeatReaper-Timestamp: Unix seconds when it was sent.
X-SeatReaper-Signature: v1= followed by the hex HMAC-SHA256 of <timestamp>.<raw body>, keyed with your signing secret.

Compute the same value over the raw body and compare in constant time, and reject timestamps more than five minutes old.

Failures