Export audit logs to your SIEM or cloud storage

1. 1

   Go to "Workspace settings" then "Security" and click on "Data exports", then "New data export".

   This is where you start the process of setting up a new automatic log export.

2. 2

   Give your export a name, like "Compliance audit log export", and choose how often Lovable should send the data (every 1 or 3 hours).

   The name helps you identify the export, and the schedule determines how frequently your logs are updated in your chosen destination.

3. 3

   Select where you want to send the data (like Amazon S3, Splunk, or Azure Log Analytics) and fill in the required details for that destination. Then, choose "Audit logs" as the source.

   This tells Lovable which logs to send and where to send them. You'll need to follow specific instructions for your chosen destination, which are linked on the page.

4. 4

   Click "Test connection" to make sure Lovable can connect to your chosen destination.

   Testing the connection early helps you fix any setup problems before you finalize the export.

5. 5

   Click "Create export" to save your settings.

   This activates the automatic log export based on your configuration.

Please set up a new data export for our workspace audit logs. I want to send them to [Amazon S3/Splunk/Azure Log Analytics] every [1/3] hour(s). The export should be named "[Your chosen export name]". I will follow the specific setup instructions for [Amazon S3/Splunk/Azure Log Analytics] to configure the destination details. Once the connection is tested, please create the export.

SIEM

A Security Information and Event Management system is a tool that collects and analyzes security alerts and other events from different sources across your computer systems to help you detect and respond to threats.

Audit logs

Records of activities that happen in your workspace, showing who did what, when, and where. These are important for security and compliance.

Amazon S3

A service from Amazon Web Services (AWS) that provides storage for large amounts of data, often called 'object storage' or 'buckets'.

Splunk

A software platform used for searching, monitoring, and analyzing machine-generated data through a web-style interface.

Azure Log Analytics

A service from Microsoft Azure that collects, indexes, and analyzes log data from various sources, helping you monitor and troubleshoot your cloud and on-premises environments.

JSON Lines

A format where each line of a file is a separate JSON (JavaScript Object Notation) object. It's good for streaming data.

Watermark

A marker that tells Lovable how much data has already been successfully exported. Resetting it makes Lovable re-export all available history.

• Do not rely on Lovable to store audit logs for longer than 13 weeks if your compliance requires it; set up data exports to your own storage.
• Do not use the one-time 'Export' button on the audit logs page if you need continuous, scheduled exports.
• Do not expect to change the source or destination (like the specific S3 bucket or Splunk endpoint) after an export is created; you'll need to make a new one.
• Do not forget that you are responsible for storage and ingestion costs in your chosen destination (S3, Splunk, Azure).
• Do not ignore connection test failures; fix them before creating the export.
• Do not forget to handle duplicate entries in your destination, as Lovable may send data more than once, especially after retries or a watermark reset.
• Do not expect to filter which events are sent; each export sends all audit log events for the workspace.
• Do not try to run an export manually if it's paused or another run is already in progress.