Stream Your Database Audit Log to Splunk, Datadog, and Elastic

PgBeam records every statement that passes through it: the SQL, the decision (allowed, blocked, or masked), the reason, rows, bytes, latency, and the credential that ran it. That audit log is queryable in the dashboard. But a log that only lives in one vendor's dashboard is a log your security team has to remember to go look at.

The point of audit export is to stop making them come to you. The events go to them, into the systems they already watch.

Two shapes of export

There are two ways events leave PgBeam, and they serve different needs.

Webhooks are for reacting in real time. You register an endpoint, and PgBeam fires an HTTP request the moment something noteworthy happens:

• a query is blocked by policy,
• a credential exhausts its budget,
• a kill-switch trips,
• an anomaly is flagged.

The webhook carries the event so your own automation can act on it: open an incident, page someone, revoke a credential, post to a channel. This is the difference between finding out an agent's queries were being blocked when you check the dashboard tomorrow, and finding out the instant it starts.

SIEM export is for the full record. You pipe the complete audit stream into your security information and event management system, where it sits alongside everything else your organization monitors. PgBeam supports the common targets:

• Splunk, via HTTP Event Collector (HEC).
• Datadog, via its logs intake.
• Elastic, via its ingest API.

Once the stream is landing in your SIEM, database access events are searchable, correlatable, and retained on the same terms as the rest of your security data. An analyst investigating an incident does not need a PgBeam login. They query the SIEM they already use.

Why this matters for agent traffic

Agent database access generates a lot of events, and the events are exactly the kind a security team wants centralized. "Which credential read the customers table, when, and was anything masked" is an audit question that comes up whether the credential belonged to an agent or a person. Routing it into the SIEM means the answer is in the same place as your application logs, your auth events, and your network telemetry, instead of stranded in a separate tool.

For agents specifically, the real-time webhook side is what lets you build closed-loop responses. An agent's query gets blocked, the webhook fires, your automation tightens the credential or flips the kill-switch, and you have reacted before a human was even aware. The audit log is not just a record after the fact. It is a stream you can act on.

The pattern

Send the full stream to your SIEM for retention and investigation. Fire webhooks on the events that warrant a reaction, blocks, exhausted budgets, tripped kill-switches, anomalies, and wire them into the automation you already run for the rest of your stack.

The audit log was always the proof of what every credential did. Export turns it from a record you check into a signal you respond to, in the tools your team already lives in.

Try PgBeam or see the full feature set.