Skip to content

Forward audit events

Forward this organization’s MCP tool calls, authentication changes, and administration events to your own observability stack. Sign-in events that happen outside an organization context are not forwarded.

Where to find it: Settings → Logging

You need Manage logging (logging:manage). The Logging tab is hidden without it. Logging destinations are a Black plan feature — otherwise the tab explains they are not in your plan.

Supported destinations

In the UI you can select:

Type Status in the product
Datadog Fully supported — events are delivered
Splunk HEC Listed as coming soon — config can be saved, but forwarding is not available yet
Microsoft Sentinel Listed as coming soon — same limitation

Use Datadog for production forwarding today.

Add a Datadog destination

  1. Open Settings → Logging.
  2. Choose Add destination.
  3. Set Type to Datadog.
  4. Enter a Name (for example Acme Datadog).
  5. Choose the Datadog site:
    • US1 (datadoghq.com)
    • US3 (us3.datadoghq.com)
    • US5 (us5.datadoghq.com)
    • EU (datadoghq.eu)
    • AP1 (ap1.datadoghq.com)
  6. Paste the Datadog API key. It is encrypted at rest and cannot be viewed after save (on edit, leave blank to keep the current key).
  7. Optionally add Tags as a comma-separated list (for example team:platform, env:prod). Elaichi sends them via Datadog’s ddtags field.
  8. Under Forwarded events, tick what to send:
    • Tool calls — MCP tool executions, including duration and status
    • Authentication — changes to members, roles, invites, domains, and API tokens
    • Administration — other organization settings changes
      Leaving all three checked forwards everything (including future event types).
  9. Choose Create.

Type cannot be changed after create. Edit name, site, tags, event filters, or rotate the API key later.

Activate, test, and delete

Control Effect
Active switch Pause or resume forwarding without deleting the destination
Test Sends a test event; success/failure and HTTP status are recorded as last test
Edit Update configuration
Delete Stops forwarding immediately and permanently deletes the stored secret

You'll know it worked when: Test reports delivered, and real events appear in Datadog shortly after activity in Elaichi.

Good to know

  • Delivery is asynchronous; a short delay after an action is normal.
  • Empty event selection means nothing is forwarded for that destination.
  • Splunk HEC and Sentinel show a warning that forwarding is not available yet — prefer Datadog until those ship.