Skip to content
downpipes docs

Forward the downpipes audit trail to Devo

Devo receives the downpipes audit trail over its HTTP endpoint. The engine dials out to your Devo endpoint on the scheduler tick and posts the audit events. Devo parses what it receives per the endpoint you send to, so set your tag on the Devo side.

Devo authenticates by a token carried in the request URL path, its own convention, rather than an auth header. The console’s push form has a URL-token option for exactly this: turn it on and the engine appends your sealed Devo token to the endpoint as the final path segment, and sends no auth header. The token never appears in an auth header, the audit trail or the delivery trail.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

What you need

  • A Devo domain with an HTTP endpoint and a token to send events.
  • Owner access to the downpipes console.

Set it up

  1. In Devo, get your HTTP endpoint and the token for it. Devo’s path format varies by relay and tag, so note the exact shape from your Devo console.
  2. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, asks for a fresh step-up sign-in).
  3. Set the sink to HTTPS endpoint and the format to NDJSON (or JSON array), to match what your Devo endpoint expects.
  4. Turn on Carry the auth token in the URL. Set the Endpoint URL to your Devo endpoint up to the point the token appends as the final path segment, and paste the token as the Auth secret.
  5. Choose Test send and confirm Devo accepts it, then Enable the destination.

What lands in Devo

The engine posts newline-delimited JSON, one raw audit event per line (or a JSON array if you chose that format):

{"seq":4097,"ts":"2026-06-19T02:14:08.221Z","actorEmail":"ops@acme.example","action":"restore-approve","outcome":"success","target":{"kind":"restore","runId":"run_01H..."},"...":"..."}

Devo tags and parses the events per the endpoint you send to, so set the tag so these land in the table you expect.

Good to know

  • Devo carries the token in the URL, so use the URL-token option, not an auth header. The engine appends the sealed token as the final path segment; because Devo’s path format varies, use Test send to confirm the reconstructed URL before enabling.
  • Delivery is at-least-once, not exactly-once. Every event carries a stable seq and hash to dedup on. The feed carries operator identity (member emails, source IPs, roles and approver emails); no backup data and no secret values. For the shared push mechanics and the pull alternative, see forwarding the audit log to your SIEM.

Last updated .