SurePath AI can export User Activity and Audit Event logs to external destinations for integration with SIEM platforms, log management tools, and data warehouses. The platform supports multiple destination types including AWS S3 buckets, Splunk HTTP Event Collector (HEC) endpoints, and generic HTTPS endpoints. Each destination can be configured to receive specific telemetry streams including user events, conversation data, and audit events.

Organizations typically configure telemetry destinations during initial deployment to establish centralized monitoring and compliance reporting. The destinations operate independently, allowing admins to send different event types to different systems or configure multiple destinations for redundancy.

SurePath AI generates three distinct types of telemetry data that can be sent to external destinations. Admins can enable or disable each event type independently for each destination, allowing precise control over what data flows to different systems.

User events capture all user interactions with GenAI services that pass through SurePath AI. Each user event includes comprehensive details about the request, policy decisions, risk assessments, intent classifications, and message content. User events represent the most detailed telemetry stream and typically generate the highest volume of data.

User events include information such as the actor (user or application), destination service, HTTP request details, network information, policy violations, risk scores, detected sensitive data, intent classifications, and token usage metrics. This data enables security teams to monitor usage patterns, identify policy violations, track sensitive data exposure, and audit GenAI interactions across the organization.

Conversation data provides supplementary context about multi-turn conversations that occur between users and GenAI services. This telemetry stream captures conversation-level metadata and relationships between individual message exchanges. Conversation data helps organizations understand how users interact with GenAI services over extended sessions rather than viewing each message as an isolated event.

Audit events record administrative actions and configuration changes within the SurePath AI platform. These events track activities such as policy modifications, user provisioning, connector configuration changes, and administrative access. Audit events are essential for compliance reporting and security investigations, as they provide a complete audit trail of who made what changes to the platform and when those changes occurred.

Organizations often send audit events to different destinations than user events because audit logs typically integrate with different downstream systems. For example, user events might flow to a security information and event management (SIEM) platform for threat detection, while audit events might go to a governance, risk, and compliance (GRC) system for compliance reporting.

SurePath AI writes telemetry data in a structured format designed for efficient processing and long-term storage. Understanding the file structure, naming conventions, and content format helps organizations integrate with downstream analytics tools.

For comprehensive information about file structure, naming conventions, compression format, and the complete telemetry schema including all JSON fields, see Telemetry schema and format.

Admins configure telemetry destinations through the SurePath AI admin interface. The telemetry configuration page displays all configured destinations and their current status, allowing admins to manage multiple destinations from a single location.

To access telemetry configuration:

The telemetry page displays a table with all configured destinations. Each destination entry shows the destination name, type (AWS S3 Bucket, Splunk HEC Index, or HTTPS Endpoint), which event types are enabled, activation status, and current status. Admins can add new destinations, edit existing configurations, or delete destinations from this page.

AWS S3 bucket destinations use role assumption through an AWS connector to write telemetry files directly to an S3 bucket. This integration eliminates the need for long-term credentials and provides a secure, scalable method for storing telemetry data. Organizations typically use S3 destinations when they want to retain telemetry data for long-term analysis, compliance archiving, or integration with AWS-native analytics tools.

The S3 integration writes compressed NDJSON files to the bucket every 15 minutes. Files are organized in a hierarchical directory structure based on UTC timestamps, making it easy to locate and process events from specific time periods.

Before configuring an S3 destination in SurePath AI, admins must complete the following prerequisites in AWS:

The AWS connector uses a CloudFormation template that creates an IAM role with permissions to write to S3 buckets. SurePath AI assumes this role when writing telemetry files, which provides secure access without requiring long-term AWS credentials.

Organizations need to configure an AWS connector before they can create S3 telemetry destinations. The connector establishes the trust relationship and permissions that allow SurePath AI to access AWS resources.

To set up an AWS connector:

The CloudFormation template creates an IAM role with a trust policy that allows SurePath AI to assume the role. The role includes permissions to create and write to S3 buckets. Once the connector is configured and the role is verified, it can be used for multiple S3 telemetry destinations.

For detailed information about the CloudFormation template and role configuration, see the Updating Access Permissions for SurePath AI's CloudFormation Stack documentation.

Admins need to gather specific information from AWS before configuring the S3 destination in SurePath AI:

To find this information in the AWS console:

Once the AWS connector is configured and the S3 bucket information is gathered, admins can create the telemetry destination in SurePath AI.

To create an S3 destination:

After saving, SurePath AI validates the connector and bucket permissions. If the validation succeeds, the destination becomes active and begins writing telemetry files to the S3 bucket every 15 minutes. If validation fails, the destination status will show an error, and admins should verify that the connector is configured correctly and that the S3 bucket name and region are accurate.

The destination URLs displayed during configuration show the full S3 paths where files will be written. User events are written to a path that includes the version number and date hierarchy (e.g., s3://bucket-name/surepath-ai/user-events/v2/YYYY/MM/DD/HH/), while audit events use a similar structure under the audit-events path.

Splunk HTTP Event Collector (HEC) destinations send telemetry events directly to Splunk indexes in real-time. This integration enables immediate visibility into GenAI usage and security events within Splunk dashboards, alerts, and analytics. Organizations use Splunk HEC destinations when they have existing Splunk deployments and want to correlate GenAI telemetry with other security and operational data.

The HEC integration sends events as soon as they are generated, providing near-real-time data delivery to Splunk. Events are formatted as JSON and include all relevant metadata, making them immediately searchable and compatible with Splunk's analytics capabilities.

Before configuring a Splunk HEC destination in SurePath AI, admins must complete the following prerequisites in Splunk:

Admins need to gather specific information from Splunk before configuring the HEC destination in SurePath AI.

HTTP Event Collector must be enabled on the Splunk deployment before tokens can receive events. On Splunk Cloud Platform, HEC is enabled by default. On Splunk Enterprise, admins must enable it manually.

To enable HEC on Splunk Enterprise:

HEC tokens provide authentication for external systems sending events to Splunk. Each token is associated with specific indexes and source type configurations.

To create an HEC token on Splunk Enterprise:

To create an HEC token on Splunk Cloud Platform:

The token value is a 32-character globally unique identifier (GUID) that looks similar to B5A79AAD-D822-46CC-80D1-819F80D7BFB0. This value must be entered in the SurePath AI configuration exactly as displayed, though it is case-insensitive.

The HEC URL is the endpoint where SurePath AI will send events. The URL format depends on whether the Splunk deployment is on-premises (Splunk Enterprise) or cloud-based (Splunk Cloud Platform).

For Splunk Enterprise, the HEC URL typically follows this format:

Where <splunk-hostname> is the hostname or IP address of the Splunk server or load balancer, and 8088 is the default HEC port (which may differ if customized during HEC configuration).

For Splunk Cloud Platform, the HEC URL is provided by Splunk and typically follows this format:

Where <deployment-name> is the unique identifier for the Splunk Cloud deployment.

To find the exact HEC URL:

SurePath AI requires separate indexes for user events and audit events. Organizations can use existing indexes or create new ones specifically for SurePath AI telemetry.

To view existing indexes in Splunk:

To create a new index in Splunk Enterprise:

For Splunk Cloud Platform, admins must submit a support request to create new indexes, as index creation is not available through the Splunk Web interface.

Organizations typically create separate indexes for user events and audit events to simplify data management, apply different retention policies, and control access permissions. User events typically generate much higher volumes than audit events, so separating them allows for independent capacity planning and retention management.

The source identifier is a text string that Splunk assigns to all events received through the HEC token. This identifier helps distinguish SurePath AI events from other data sources within Splunk indexes.

Organizations can choose any meaningful source identifier. Common patterns include:

The source identifier is configured in the HEC token settings under the "Source name override" field when creating the token. If no source override is specified, Splunk uses a default source value based on the client connection.

Once all the required information is gathered from Splunk, admins can create the HEC telemetry destination in SurePath AI.

To create a Splunk HEC destination:

After saving, SurePath AI validates the connection to the Splunk HEC endpoint by attempting to send a test event. If the validation succeeds, the destination becomes active and begins sending telemetry events to Splunk in real-time. If validation fails, the destination status will show an error, and admins should verify that the HEC URL, token, and index names are correct.

The "Allow self-signed certificates" option should only be enabled when connecting to Splunk deployments that use self-signed SSL certificates, such as development or test environments. Production Splunk deployments should use certificates signed by a trusted certificate authority, and this option should remain disabled.

HTTPS endpoint destinations provide a generic integration method that sends telemetry events to any HTTPS endpoint. This destination type enables organizations to integrate SurePath AI telemetry with custom applications, third-party SIEM platforms, log aggregation services, or data warehouses that accept data over HTTP.

The HTTPS endpoint integration sends events in real-time as JSON payloads to the configured URL. Each event is sent as a separate HTTP POST request with authentication headers as specified in the destination configuration.

The destination endpoint must meet the following requirements to receive SurePath AI telemetry:

Organizations implementing custom HTTPS endpoints should ensure that the endpoint can handle the expected volume of telemetry events. User events typically generate the highest volume, with event rates varying based on organizational GenAI usage patterns.

Before configuring an HTTPS endpoint destination, admins need to gather the following information from the destination system:

Once the endpoint information is gathered, admins can create the HTTPS endpoint destination in SurePath AI.

To create an HTTPS endpoint destination with Bearer authentication:

To create an HTTPS endpoint destination with custom authentication:

After saving, SurePath AI validates the connection to the HTTPS endpoint by attempting to send a test event. If the validation succeeds, the destination becomes active and begins sending telemetry events in real-time. If validation fails, the destination status will show an error, and admins should verify that the endpoint URL, authentication type, and token are correct.

Bearer authentication is the most common authentication method for REST APIs and follows the standard HTTP Bearer authentication scheme. When Bearer authentication is selected, SurePath AI sends requests with an Authorization header containing the value Bearer <token>. Custom authentication allows organizations to specify any header name and token format required by their endpoint.

After creating telemetry destinations, admins can modify configurations, enable or disable destinations, and monitor delivery status through the telemetry configuration interface.

To modify an existing telemetry destination:

Changes to telemetry destinations take effect immediately. If a destination is currently enabled and delivering events, modifying the configuration may cause a brief interruption in event delivery while the new settings are validated.

Destinations can be temporarily disabled without deleting the configuration. This is useful when troubleshooting destination issues, performing maintenance on the receiving system, or temporarily reducing telemetry volume.

To disable a destination:

To enable a destination:

When a destination is disabled, SurePath AI stops sending events to that destination immediately. Events generated while a destination is disabled are not queued or retried; they are simply not sent to the disabled destination. Other destinations continue to receive events normally.

Deleting a telemetry destination permanently removes the configuration and stops all event delivery to that destination. This action cannot be undone.

To delete a destination:

Organizations should disable destinations first and verify that the destination is no longer needed before deleting it. Once deleted, the destination configuration must be recreated entirely if the destination needs to be restored.

The telemetry destination list displays the current status of each configured destination. Status indicators help admins identify destinations that are operating normally versus those that have configuration issues or delivery failures.

Common status indicators include:

When a destination shows an error status, admins should click on the destination to view detailed error information. Common error conditions include invalid credentials, network connectivity issues, incorrect endpoint URLs, or insufficient permissions to write to the target system.

All telemetry destinations receive events in a structured JSON format. The specific format and schema version depend on the destination type and when the destination was created.

SurePath AI uses schema version 2 for all new telemetry destinations. This version provides a comprehensive event structure with detailed policy decision information, risk assessments, intent classifications, and message content.

For detailed information about the telemetry schema, including all available JSON fields, data types, descriptions, and format examples, see Telemetry schema and format.

Organizations implementing SurePath AI telemetry should start by configuring a single destination for user events. This allows admins to validate that events are flowing correctly, understand the data volume and format, and confirm that downstream systems can process the events before expanding to multiple destinations or adding audit events.

Consider configuring separate destinations for user events and audit events when the events need to flow to different systems or require different retention policies. For example, send user events to a SIEM platform for security monitoring while sending audit events to a compliance logging system.

For S3 destinations, implement S3 lifecycle policies to automatically archive or delete old telemetry files according to organizational data retention requirements. For Splunk destinations, configure index retention policies that align with compliance requirements and storage capacity.

Name telemetry destinations descriptively to indicate the destination system and purpose (e.g., "Splunk Production SIEM", "AWS Compliance Archive", "QRadar Security Analytics"). This helps admins identify destinations quickly and understand their purpose when reviewing configurations.