The audit stream sends your team's activity, as it happens, to your SIEM or log collector: signed JSON posts to an HTTPS endpoint you choose. The events are the ones in the activity log, with the email addresses of the people involved.
The audit stream is part of the Business plan and the team trial, on morphgate.com.
Set it up
- On the team page at morphgate.com, under Audit stream, enter the Endpoint (https) and choose Start streaming.
- The page shows the signing secret once. Copy it into your receiver now; it can't be shown again.
- Choose Send a test. MorphGate posts a test message and shows what your endpoint answered.
A new stream starts with the next event; history isn't sent. To get the history, download the activity log.
What is sent
MorphGate posts new events in order, up to 500 per request, as JSON with "type": "events", the team's id and a list of events. Each event has a sequence number, the time, the kind, who did it and to whom (id and email), the vault, and a detail. The test message has "type": "ping" and no events.
Verify the signature
Each request carries a MorphGate-Signature header of the form t=<unix time>,v1=<hex>. v1 is the HMAC-SHA-256 of the string <t>.<raw body>, keyed with your signing secret. Compute it over the raw body, compare in constant time, and reject old timestamps.
Delivery
- Any 2xx answer counts as delivered.
- Anything else, or no answer, counts as a failure. MorphGate tries again later, waiting 2 minutes at first and up to an hour.
- After 24 failures in a row, about a day, the stream stops. The owner is emailed, and the activity log records it. Fix the endpoint and choose Turn on again: the stream sends everything it missed.
- Delivery is at least once. A request that arrived but whose answer was lost is sent again, so de-duplicate by sequence number, which is unique per team and always increasing.
The team page shows the endpoint, the last event delivered, the last delivery, your endpoint's last answer, and the state.
Change it
- Change endpoint changes only the address. The secret and the place in the stream stay the same.
- New secret replaces the signing secret.
- Remove stops and deletes the stream.
Setting up, changing the secret and removing the stream are recorded in the activity log.
If the team leaves Business
The stream pauses. Nothing is lost: when the team is on Business again, it catches up with every event still kept in the log. You can always remove it.