Streaming Audit Logs via Webhook

Harmony can forward audit log events to an external destination in real time via webhook. Each time a tracked user action occurs, Harmony sends an HTTP POST request containing a JSON payload to the URL you configure. This makes it straightforward to integrate your activity history with SIEM tools, log aggregation platforms such as Sumo Logic, and compliance systems - without any additional tooling or manual exports.

Supported Event Types

The following categories of events are captured and forwarded to your webhook destination:

• Authentication events - user sign-ins and sign-outs
• Asset actions - create, update, delete, and assignment changes
• Ticket and service desk actions - status changes and mutations

As Harmony adds support for additional tracked actions, they will be included in the stream automatically.

Configuring a Webhook Destination

To set up audit log streaming:

1. Navigate to Settings in your Harmony workspace.
2. Locate the Audit Logs section and select Webhook.
3. Enter the destination URL in the Webhook URL field. This must be a publicly reachable HTTPS endpoint that accepts HTTP POST requests.
4. Save your configuration.

Once saved, Harmony will begin forwarding new audit events to the specified URL immediately. Events that occurred before the webhook was configured are not retroactively delivered.

Payload Format

Each event is delivered as an HTTP POST request with a Content-Type: application/json header. The request body contains a JSON object describing the event, including details such as the event type, the user who performed the action, a timestamp, and any relevant resource identifiers.

The exact fields in the payload vary by event type, but all payloads share a common structure so you can parse and route them consistently in your receiving system.

Receiving and Verifying Events

Your endpoint should return a 2xx HTTP status code to acknowledge successful receipt. If Harmony does not receive a successful response, it may retry delivery.

To ensure the events you receive originate from Harmony, we recommend:

• Restricting access to your endpoint so only known Harmony IP ranges are accepted, if your infrastructure supports it.
• Validating the structure and required fields of each incoming payload before processing it.

Use Cases

• SIEM integration - forward events directly into your security information and event management platform to correlate Harmony activity with signals from other systems.
• Log aggregation - stream events into platforms such as Sumo Logic for long-term retention, search, and dashboarding.
• Compliance auditing - maintain a real-time, tamper-evident record of user actions in an external system that your compliance or legal team controls.

Troubleshooting

Events are not arriving at my endpoint Confirm that the destination URL is publicly reachable and returns a 2xx status code. Check that no firewall or authentication layer is blocking inbound requests from Harmony.

My endpoint is receiving duplicate events This can occur if your endpoint did not return a successful response during a previous delivery attempt, triggering a retry. Implement idempotency handling in your receiver using a unique event identifier from the payload.

I need to change the destination URL Return to Settings > Audit Logs > Webhook, update the URL, and save. The new destination takes effect for all events going forward.