Interface AuditExportOptions<TEvent>

interface AuditExportOptions<TEvent = unknown> {
    endpoint: string;
    fetch?: AuditExportFetch;
    headers?: Record<string, string>;
    transform?: (event: TEvent) => unknown;
}

Properties

endpoint: string

HTTP event-collector URL (Splunk HEC, Datadog intake, Elastic, ...).

Defaults to the global fetch.

headers?: Record<string, string>

Merged over the NDJSON content-type (so it can be overridden), e.g. { authorization: 'Splunk <token>' }.

transform?: (event: TEvent) => unknown

Per-event reshaping for SIEM-specific envelopes — Splunk HEC wants (event) => ({ event }). Default: the event itself.