Integrating OneTrust Activity Logs with External SIEM Tools

You can configure an integration to pass activity records from the OneTrust Platform to external systems such as your Security Information and Event Management (SIEM) tools. These transactions are asynchronous, so events may not appear in real time. Filtering can be applied to only trigger the integration on certain conditions. Configuring this integration provides you with the ability to extract consistent logs of various activity events across objects throughout the platform to utilize within your SIEM services.

For more information about audit histories, see OneTrust Activity Log.

Legacy Activity Integration Trigger Deprecation

The Activity Record Created (Legacy) trigger will be supported alongside the standardized audit event (known as Activity Record Created until the Spring '27 release. After that transition period, the legacy event is planned for deprecation. This name change will not have any impact on the existing configurations. If your integration uses the Activity Record Created (Legacy) trigger in your integrations, you will need to update them with the standardized audit event before deprecation.

The new Activity Record Created trigger provides audit information in a standardized format intended for SIEM tools. This allows users to integrate OneTrust audit data into a SIEM or security data lake in a enterprise-grade schema against our specific payload structures.

New Open API JSON

OneTrust has a developer resource covering the standardized format, field mappings from the legacy payload, and a migration guide to help our customers update or rebuild integrations independently. Refer to our GitLab OneTrust Activity Log - Standardized Integration Event documentation (requires login).

To send activity logs to external SIEM tool

  1. On the Integrations menu, select Integrations. The Integrations screen appears
    Note:

    Alternatively, you can select Gallery to access the Integrations gallery screen, where you can create integrations using out-of-the-box SIEM connectors, such as Splunk, or select Generic to post to your desired SIEM tool.

  2. Click the Add integration button.


    Field
    Description
    Integration name

    Enter a name for the integration.

    Description(Optional)

    Enter a description for the integration.

    System

    Select your SIEM tool to which you want to send activity logs.

    Notification email

    Enter a valid email address to which notifications will be sent.

  3. Click the Add button.


    The Integration builder screen appears.

  4. Select Activity Log and click Activity Record Created to configure the OneTrust trigger from which the integration should launch.


  5. Complete the conditions block that appears to apply filtering options in order to trigger the integration for a certain product, object, etc. Then click the Done button.
  6. Click the Add action button and select the POST action to send events from the OneTrust platform to your SIEM tools when the conditions are met. Then select your credentials, and click the Next button.
    Important:

    Although HTTP POST request URLs are the primary documented method for sending activity log data to external SIEM tools, the Workflow Builder supports multiple integration patterns. Depending on the use case, you can use generic actions, apply filtering and transformation logic before delivery, route events through reusable subflows, or leverage other supported integration targets and export mechanisms.

  7. In the Request URL field, specify the required endpoint for your SIEM tool and complete the remaining fields as necessary. Then click the Finish button.


  8. Click the Save button. You can then test and activate your integration when ready.

    For more information, see Managing Custom Integrations.

What types of logs are supported?

OneTrust supports passing the following types of activity logs from the OneTrust Platform to external systems such as your SIEM tools:

  • History of changes made to a user's profile, including events such as creating a user, editing a user's details, updating a user's roles, and deactivating a user

  • History of changes made to the organizational hierarchy, including events such as creating, updating, and deleting an organization and moving the organization within the hierarchy

  • History of changes made to user groups, including events such as adding a user group, updating or removing roles from the user group, and deleting a user group

  • Various activity events for objects across the platform, such as creating, updating, and deleting an audit