Integrate audit logs with SIEM tools
To get the most value from your audit logs, integrate them with your organization's security information and event management (SIEM) system. This centralizes visibility and allows your security team to detect and respond to unusual activity in real time.
Common integrations include:
Splunk: Use the Tines Stories API to fetch audit logs and send them to Splunk via HTTP Event Collector.
Datadog: Build a story that runs on a schedule, pulls audit logs, and forwards them to Datadog's log ingestion API.
Snowflake: Export audit logs to S3, then use Snowflake's S3 integration to load them into your data warehouse for analysis.
🪄Tip
Build stories to monitor audit logs
Beyond sending logs to external tools, work with your builders to create stories that monitor audit logs for specific patterns and alert you when something unusual happens. For example:
Alert when a user deletes more than five credentials in a single day.
Notify security when a new tenant owner is added.
Flag when someone accesses the tenant from an unexpected country.
These monitoring stories run within Tines Stories itself, giving you an additional layer of oversight.
Compliance frameworks and considerations
While Tines Stories provides the tools for security and compliance, how you use them depends on your organization's specific requirements. Here are some common frameworks and how Tines Stories features support them:
SOC 2: Audit logs provide evidence of access controls and change management. IP access control demonstrates network security measures.
GDPR: Audit logs help you track data access and modifications. Action egress control can prevent data from being sent to unauthorized destinations.
ISO 27001: Login notices support acceptable use policies. Custom session timeouts align with access control requirements.
🪄Tip
Document your processes
Strong security isn't just about configuring features. It's also about maintaining clear documentation and processes:
Document why each IP access rule exists and who requested it.
Keep a record of what destinations are on your egress control allowlist and why.
Regularly review audit logs for unusual patterns.
Test your security controls periodically to ensure they're working as expected.
Maintain a runbook for emergency access scenarios (like using recovery codes if you're locked out).