> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Log Integration

> Forward Formal logs to your SIEM, data lake, or observability platform

## Overview

Formal can forward all activity logs to your SIEM, data lake, or observability platform. This enables centralized log management, long-term retention, compliance reporting, and integration with your existing security tools.

## Supported Platforms

<img src="https://mintcdn.com/formal/fJsHlx-X_b_ATHwb/assets/images/supported_logs.png?fit=max&auto=format&n=fJsHlx-X_b_ATHwb&q=85&s=d79b65063a6f25895b38f14d939db232" alt="Supported log destinations" width="2512" height="958" data-path="assets/images/supported_logs.png" />

* **AWS S3**
* **Datadog**
* **Splunk**

<Note>
  By default, Formal forwards **all logs** to your configured destination.
</Note>

## Setup

### AWS S3

<Warning>
  The AWS S3 log integration requires an [AWS Cloud Integration](/docs/guides/integrations/clouds) with S3 access enabled.
</Warning>

<Steps>
  <Step title="Set Up AWS Integration">
    First, configure an [AWS Cloud Integration](/docs/guides/integrations/clouds) with:

    * **AllowS3Access**: `true`
    * **S3BucketARN**: Your S3 bucket ARN
  </Step>

  <Step title="Navigate to Log Integrations">
    Go to [Log Integrations](https://app.formal.ai/log-integrations)
  </Step>

  <Step title="Create Integration">Click **Create Log Integration**</Step>
  <Step title="Select AWS S3">Choose AWS S3 as your provider</Step>

  <Step title="Configure">
    * **S3 Bucket Name**: Your bucket name
    * **Cloud Integration**: Select your AWS Cloud Integration
  </Step>
</Steps>

#### Terraform

```hcl theme={null}
# First, create S3 bucket
resource "aws_s3_bucket" "formal_logs" {
  bucket = "formal-connector-logs"
}

# Create AWS Cloud Integration
resource "formal_integration_cloud" "aws" {
  name         = "aws-integration"
  cloud_region = "us-east-1"

  aws {
    template_version    = "1.2.0"
    allow_s3_access     = true
    s3_bucket_arn       = "${aws_s3_bucket.formal_logs.arn}/*"
  }
}

# Deploy CloudFormation stack (see AWS Integration guide)
resource "aws_cloudformation_stack" "formal" {
  # ... (see AWS Integration docs)
}

# Create log integration
resource "formal_integration_log" "s3" {
  name = "s3-log-drain"

  s3 {
    s3_bucket_name       = aws_s3_bucket.formal_logs.bucket
    cloud_integration_id = formal_integration_cloud.aws.id
  }
}
```

### Datadog

<Steps>
  <Step title="Get Datadog Credentials">
    From your Datadog account, retrieve:

    * Application Key
    * API Key
    * Site (e.g., `datadoghq.com`, `datadoghq.eu`)
  </Step>

  <Step title="Navigate to Log Integrations">
    Go to [Log Integrations](https://app.formal.ai/log-integrations)
  </Step>

  <Step title="Create Integration">Click **Create Log Integration**</Step>
  <Step title="Select Datadog">Choose Datadog as your provider</Step>

  <Step title="Enter Credentials">
    * **Application Key**: Your Datadog Application Key
    * **API Key**: Your Datadog API key
    * **Site**: Your Datadog site
  </Step>
</Steps>

#### Terraform

```hcl theme={null}
resource "formal_integration_log" "datadog" {
  name = "datadog-log-drain"

  datadog {
    account_id = var.datadog_application_key
    api_key    = var.datadog_api_key
    site       = "datadoghq.com"  # or datadoghq.eu, etc.
  }
}
```

#### Datadog Dashboard

Import [this template JSON](/assets/json/datadog_log_integration_dashboard.json) for a sample of some of the analyses you can do with the Datadog log integration.

### Splunk

<Steps>
  <Step title="Create Splunk HEC Token">
    In Splunk, create a new HTTP Event Collector (HEC) token
  </Step>

  <Step title="Navigate to Log Integrations">
    Go to [Log Integrations](https://app.formal.ai/log-integrations)
  </Step>

  <Step title="Create Integration">Click **Create Log Integration**</Step>
  <Step title="Select Splunk">Choose Splunk as your provider</Step>

  <Step title="Enter Configuration">
    * **Access Token**: Your HEC token
    * **Host**: Your Splunk instance hostname
    * **Port**: HEC port (usually 8088)
  </Step>
</Steps>

#### Terraform

```hcl theme={null}
resource "formal_integration_log" "splunk" {
  name = "splunk-log-drain"

  splunk {
    access_token = var.splunk_hec_token
    host         = "splunk.example.com"
    port         = 8088
  }
}
```

## Use Cases

### Compliance and Auditing

Forward logs to long-term storage for compliance requirements:

```hcl theme={null}
# Archive to S3 for 7 years (SOC 2, HIPAA, etc.)
resource "formal_integration_log" "compliance_archive" {
  name = "compliance-s3-archive"

  s3 {
    s3_bucket_name       = aws_s3_bucket.compliance_logs.bucket
    cloud_integration_id = formal_integration_cloud.aws.id
  }
}

# Configure S3 lifecycle policy
resource "aws_s3_bucket_lifecycle_configuration" "compliance" {
  bucket = aws_s3_bucket.compliance_logs.id

  rule {
    id     = "archive-old-logs"
    status = "Enabled"

    transition {
      days          = 90
      storage_class = "GLACIER"
    }

    expiration {
      days = 2555  # 7 years
    }
  }
}
```

### Real-Time Security Monitoring

Send logs to your SIEM for real-time threat detection:

```hcl theme={null}
# Send to Datadog for real-time monitoring
resource "formal_integration_log" "security_monitoring" {
  name = "datadog-security"

  datadog {
    account_id = var.datadog_application_key
    api_key    = var.datadog_api_key
    site       = "datadoghq.com"
  }
}
```

Create alerts in Datadog for:

* Failed authentication attempts
* Policy violations
* Unusual query patterns
* Off-hours access

### Data Lake Integration

Forward logs to your data lake for analytics:

```hcl theme={null}
# Send to S3 data lake
resource "formal_integration_log" "data_lake" {
  name = "data-lake-integration"

  s3 {
    s3_bucket_name       = "my-data-lake-formal-logs"
    cloud_integration_id = formal_integration_cloud.aws.id
  }
}
```

Then use Athena, Redshift Spectrum, or Databricks to analyze:

* User access patterns
* Query performance
* Policy effectiveness
* Resource utilization

### Multi-Destination Forwarding

Send logs to multiple destinations:

```hcl theme={null}
# Real-time monitoring
resource "formal_integration_log" "splunk_realtime" {
  name = "splunk-realtime"
  splunk {
    access_token = var.splunk_hec_token
    host         = "splunk.example.com"
    port         = 8088
  }
}

# Long-term archive
resource "formal_integration_log" "s3_archive" {
  name = "s3-archive"
  s3 {
    s3_bucket_name       = "formal-logs-archive"
    cloud_integration_id = formal_integration_cloud.aws.id
  }
}

# Security analytics
resource "formal_integration_log" "datadog_security" {
  name = "datadog-security"
  datadog {
    account_id = var.datadog_application_key
    api_key    = var.datadog_api_key
    site       = "datadoghq.com"
  }
}
```

## Next Steps

<CardGroup cols={2}>
  <Card title="AWS Integration" icon="aws" href="/docs/guides/integrations/clouds">
    Set up AWS Cloud Integration for S3 logs
  </Card>

  <Card title="View Logs" icon="file-lines" href="/docs/guides/observability/logs">
    Monitor logs in the Formal console
  </Card>
</CardGroup>