# Audit log streaming

Stream the audit log to your SIEM as it happens.

```sh
harebox audit sink new --kind s3 --url s3://my-bucket/harebox-audit
harebox audit sink list
```

A `webhook` sink gets the entries after its last batch, about once a minute, as `{"sink": ..., "entries": [...]}`, signed with `HareBox-Signature` the same way [webhooks](../guides/webhooks.html) are. Its `secret` is shown once, when you create it. A sink starts from when it's made; earlier entries are in `harebox audit`. An `s3` sink is recorded, but no bucket is written yet.