diff --git a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
index 2ee4dff92..fab5f16b7 100644
--- a/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
+++ b/docs/documentation/platform/audit-log-streams/audit-log-streams.mdx
@@ -6,84 +6,133 @@ description: "Learn how to stream Infisical Audit Logs to external logging provi
Audit log streams is a paid feature.
- If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical,
- then you should contact team@infisical.com to purchase an enterprise license to use it.
+ If you're using Infisical Cloud, then it is available under the **Enterprise Tier**. If you're self-hosting Infisical, then you should contact team@infisical.com to purchase an enterprise license to use it.
-Infisical Audit Log Streaming enables you to transmit your organization's Audit Logs to external logging providers for monitoring and analysis.
-
-The logs are formatted in JSON, requiring your logging provider to support JSON-based log parsing.
-
+Infisical Audit Log Streaming enables you to transmit your organization's audit logs to external logging providers for monitoring and analysis.
## Overview
-
-
- 
-
-
- 
+
+ 1. Navigate to **Organization Settings**
+ 2. Select the **Audit Log Streams** tab
+ 3. Click **Add Log Stream**
- Provide the following values
-
- The HTTPS endpoint URL of the logging provider that collects the JSON stream.
-
-
- The HTTP headers for the logging provider for identification and authentication.
-
+ 
+
+
+ If your log provider is included in this list, select it. Otherwise click on **Custom** to input your own Endpoint URL and headers.
+
+ 
+
+
+ Depending on your chosen provider, you'll be asked to input different credentials.
+
+ For **Custom**, you need to input an endpoint URL and headers.
+
+ 
+
+ Once you're finished, click **Create Log Stream**.
+
+
+ Your audit logs are now ready to be streamed.
+
+ 
-
-Your Audit Logs are now ready to be streamed.
-
## Example Providers
-### Better Stack
+
+
+ You can stream to Better Stack using a **Custom** log stream.
-
-
- 
-
-
-
- 
+
+
+ On Better Stack, select **Connect Source** and click **Create source** after providing a name.
- 1. Copy the **endpoint** from Better Stack to the **Endpoint URL** field.
- 3. Create a new header with key **Authorization** and set the value as **Bearer \**.
-
-
+ 
-### Datadog
+ Once your source is created, take note of the **endpoint** and **Source token** for the next step.
-
-
- 
-
-
- 
- 
-
-
- 
+ 
+
+
+ On Infisical, create a new audit log stream and select the **Custom** option.
- 1. Navigate to the [Datadog Send Logs API documentation](https://docs.datadoghq.com/api/latest/logs/?code-lang=curl&site=us5#send-logs).
- 2. Pick your Datadog account region.
- 3. Obtain your Datadog logging endpoint URL.
-
-
- 
+ 
- 1. Copy the **logging endpoint** from Datadog to the **Endpoint URL** field.
- 2. Copy the **API Key** from previous step
- 3. Create a new header with key **DD-API-KEY** and set the value as **API Key**.
-
-
+ 1. Fill in the endpoint URL with your Better Stack source endpoint
+ 2. Create a new header with key `Authorization` and set the value as `Bearer `
-## Audit Log Stream Data
+ 
-Each log entry sent to the external logging provider will follow the same structure.
+ Once you're finished, click **Create Log Stream**.
+
+
+
+
+ You can stream to Datadog using the **Datadog** provider log stream.
+
+
+
+ 
+
+
+ 
+ 
+
+
+ On Infisical, create a new audit log stream and select the **Datadog** provider option.
+
+ Input your **Datadog Region** and the **Token** obtained from step 2.
+
+ 
+
+ Once you're finished, click **Create Log Stream**.
+
+
+
+
+ You can stream to Splunk using the **Splunk** provider log stream.
+
+
+
+ Navigate to **Settings** > **Data Inputs**.
+
+ 
+
+ Click on **HTTP Event Collector**.
+
+ 
+
+ Click on **New Token** in the top left.
+
+ 
+
+ Provide a name and click **Next**.
+
+ 
+
+ On the next page, click **Review** and then **Submit** at the top. On the final page you'll see your token.
+
+ Copy the **Token Value** and your Splunk hostname from the URL to be used for later.
+
+ 
+
+
+ On Infisical, create a new audit log stream and select the **Splunk** provider option.
+
+ Input your **Splunk Hostname** and the **Token** obtained from step 1.
+
+ 
+
+ Once you're finished, click **Create Log Stream**.
+
+
+
+
### Example Log Entry
@@ -117,106 +166,109 @@ Each log entry sent to the external logging provider will follow the same struct
```
### Audit Logs Structure
+
+
+ Streamed audit log structure **varies based on provider**, but they all share the audit log fields shown below.
+
+
- The unique identifier for the log entry.
+ The unique identifier for the log entry.
- The entity responsible for performing or causing the event; this can be a user or service.
+ The entity responsible for performing or causing the event; this can be a user or service.
- The metadata associated with the actor. This varies based on the actor type.
+ The metadata associated with the actor. This varies based on the actor type.
-
- This metadata is present when the `actor` field is set to `user`.
+
+
+ This metadata is present when the `actor` field is set to `user`.
-
- The unique identifier for the actor.
-
-
- The email address of the actor.
-
-
- The username of the actor.
-
-
+
+ The unique identifier for the actor.
+
+
+ The email address of the actor.
+
+
+ The username of the actor.
+
+
+
+ This metadata is present when the `actor` field is set to `identity`.
-
- This metadata is present when the `actor` field is set to `identity`.
+
+ The unique identifier for the identity.
+
+
+ The name of the identity.
+
+
+
+ This metadata is present when the `actor` field is set to `service`.
-
- The unique identifier for the identity.
-
-
- The name of the identity.
-
-
-
-
- This metadata is present when the `actor` field is set to `service`.
-
-
- The unique identifier for the service.
-
-
- The name of the service.
-
-
-
-
-
- If the `actor` field is set to `platform`, `scimClient`, or `unknownUser`, the `actorMetadata` field will be an empty object.
-
+
+ The unique identifier for the service.
+
+
+ The name of the service.
+
+
+
+
+ If the `actor` field is set to `platform`, `scimClient`, or `unknownUser`, the `actorMetadata` field will be an empty object.
+
- The IP address of the actor.
+ The IP address of the actor.
- The type of event that occurred. Below you can see a list of possible event types. More event types will be added in the future as we expand our audit logs further.
+ The type of event that occurred. Below you can see a list of possible event types. More event types will be added in the future as we expand our audit logs further.
- `get-secrets`, `delete-secrets`, `get-secret`, `create-secret`, `update-secret`, `delete-secret`, `get-workspace-key`, `authorize-integration`, `update-integration-auth`, `unauthorize-integration`, `create-integration`, `delete-integration`, `add-trusted-ip`, `update-trusted-ip`, `delete-trusted-ip`, `create-service-token`, `delete-service-token`, `create-identity`, `update-identity`, `delete-identity`, `login-identity-universal-auth`, `add-identity-universal-auth`, `update-identity-universal-auth`, `get-identity-universal-auth`, `create-identity-universal-auth-client-secret`, `revoke-identity-universal-auth-client-secret`, `get-identity-universal-auth-client-secret`, `create-environment`, `update-environment`, `delete-environment`, `add-workspace-member`, `remove-workspace-member`, `create-folder`, `update-folder`, `delete-folder`, `create-webhook`, `update-webhook-status`, `delete-webhook`, `webhook-triggered`, `get-secret-imports`, `create-secret-import`, `update-secret-import`, `delete-secret-import`, `update-user-workspace-role`, `update-user-workspace-denied-permissions`, `create-certificate-authority`, `get-certificate-authority`, `update-certificate-authority`, `delete-certificate-authority`, `get-certificate-authority-csr`, `get-certificate-authority-cert`, `sign-intermediate`, `import-certificate-authority-cert`, `get-certificate-authority-crl`, `issue-cert`, `get-cert`, `delete-cert`, `revoke-cert`, `get-cert-body`, `create-pki-alert`, `get-pki-alert`, `update-pki-alert`, `delete-pki-alert`, `create-pki-collection`, `get-pki-collection`, `update-pki-collection`, `delete-pki-collection`, `get-pki-collection-items`, `add-pki-collection-item`, `delete-pki-collection-item`, `org-admin-accessed-project`, `create-certificate-template`, `update-certificate-template`, `delete-certificate-template`, `get-certificate-template`, `create-certificate-template-est-config`, `update-certificate-template-est-config`, `get-certificate-template-est-config`, `update-project-slack-config`, `get-project-slack-config`, `integration-synced`, `create-shared-secret`, `delete-shared-secret`, `read-shared-secret`.
+ `get-secrets`, `delete-secrets`, `get-secret`, `create-secret`, `update-secret`, `delete-secret`, `get-workspace-key`, `authorize-integration`, `update-integration-auth`, `unauthorize-integration`, `create-integration`, `delete-integration`, `add-trusted-ip`, `update-trusted-ip`, `delete-trusted-ip`, `create-service-token`, `delete-service-token`, `create-identity`, `update-identity`, `delete-identity`, `login-identity-universal-auth`, `add-identity-universal-auth`, `update-identity-universal-auth`, `get-identity-universal-auth`, `create-identity-universal-auth-client-secret`, `revoke-identity-universal-auth-client-secret`, `get-identity-universal-auth-client-secret`, `create-environment`, `update-environment`, `delete-environment`, `add-workspace-member`, `remove-workspace-member`, `create-folder`, `update-folder`, `delete-folder`, `create-webhook`, `update-webhook-status`, `delete-webhook`, `webhook-triggered`, `get-secret-imports`, `create-secret-import`, `update-secret-import`, `delete-secret-import`, `update-user-workspace-role`, `update-user-workspace-denied-permissions`, `create-certificate-authority`, `get-certificate-authority`, `update-certificate-authority`, `delete-certificate-authority`, `get-certificate-authority-csr`, `get-certificate-authority-cert`, `sign-intermediate`, `import-certificate-authority-cert`, `get-certificate-authority-crl`, `issue-cert`, `get-cert`, `delete-cert`, `revoke-cert`, `get-cert-body`, `create-pki-alert`, `get-pki-alert`, `update-pki-alert`, `delete-pki-alert`, `create-pki-collection`, `get-pki-collection`, `update-pki-collection`, `delete-pki-collection`, `get-pki-collection-items`, `add-pki-collection-item`, `delete-pki-collection-item`, `org-admin-accessed-project`, `create-certificate-template`, `update-certificate-template`, `delete-certificate-template`, `get-certificate-template`, `create-certificate-template-est-config`, `update-certificate-template-est-config`, `get-certificate-template-est-config`, `update-project-slack-config`, `get-project-slack-config`, `integration-synced`, `create-shared-secret`, `delete-shared-secret`, `read-shared-secret`.
- The metadata associated with the event. This varies based on the event type.
+ The metadata associated with the event. This varies based on the event type.
- The user agent of the actor, if applicable.
+ The user agent of the actor, if applicable.
- The type of user agent.
+ The type of user agent.
- The expiration date of the log entry. When this date is reached, the log entry will be deleted from Infisical.
+ The expiration date of the log entry. When this date is reached, the log entry will be deleted from Infisical.
- The creation date of the log entry.
+ The creation date of the log entry.
- The last update date of the log entry. This is unlikely to be out of sync with the `createdAt` field, as we do not update log entries after they've been created.
+ The last update date of the log entry. This is unlikely to be out of sync with the `createdAt` field, as we do not update log entries after they've been created.
- The unique identifier for the organization where the event occurred.
+ The unique identifier for the organization where the event occurred.
- The unique identifier for the project where the event occurred.
+ The unique identifier for the project where the event occurred.
- The `projectId` field will only be present if the event occurred at the project level, not the organization level.
+ The `projectId` field will only be present if the event occurred at the project level, not the organization level.
- The name of the project where the event occurred.
+ The name of the project where the event occurred.
- The `projectName` field will only be present if the event occurred at the project level, not the organization level.
+ The `projectName` field will only be present if the event occurred at the project level, not the organization level.
diff --git a/docs/images/platform/audit-log-streams/custom-provider.png b/docs/images/platform/audit-log-streams/custom-provider.png
new file mode 100644
index 000000000..e860e2e90
Binary files /dev/null and b/docs/images/platform/audit-log-streams/custom-provider.png differ
diff --git a/docs/images/platform/audit-log-streams/datadog-details.png b/docs/images/platform/audit-log-streams/datadog-details.png
new file mode 100644
index 000000000..29b1464be
Binary files /dev/null and b/docs/images/platform/audit-log-streams/datadog-details.png differ
diff --git a/docs/images/platform/audit-log-streams/datadog-logging-endpoint.png b/docs/images/platform/audit-log-streams/datadog-logging-endpoint.png
deleted file mode 100644
index 7960b1145..000000000
Binary files a/docs/images/platform/audit-log-streams/datadog-logging-endpoint.png and /dev/null differ
diff --git a/docs/images/platform/audit-log-streams/datadog-source-details.png b/docs/images/platform/audit-log-streams/datadog-source-details.png
deleted file mode 100644
index 5ae25b0b3..000000000
Binary files a/docs/images/platform/audit-log-streams/datadog-source-details.png and /dev/null differ
diff --git a/docs/images/platform/audit-log-streams/select-custom.png b/docs/images/platform/audit-log-streams/select-custom.png
new file mode 100644
index 000000000..7a55b24a7
Binary files /dev/null and b/docs/images/platform/audit-log-streams/select-custom.png differ
diff --git a/docs/images/platform/audit-log-streams/select-provider.png b/docs/images/platform/audit-log-streams/select-provider.png
new file mode 100644
index 000000000..c289fd3af
Binary files /dev/null and b/docs/images/platform/audit-log-streams/select-provider.png differ
diff --git a/docs/images/platform/audit-log-streams/splunk-credentials.png b/docs/images/platform/audit-log-streams/splunk-credentials.png
new file mode 100644
index 000000000..8b8624700
Binary files /dev/null and b/docs/images/platform/audit-log-streams/splunk-credentials.png differ
diff --git a/docs/images/platform/audit-log-streams/splunk-data-inputs.png b/docs/images/platform/audit-log-streams/splunk-data-inputs.png
new file mode 100644
index 000000000..3446f89f3
Binary files /dev/null and b/docs/images/platform/audit-log-streams/splunk-data-inputs.png differ
diff --git a/docs/images/platform/audit-log-streams/splunk-details.png b/docs/images/platform/audit-log-streams/splunk-details.png
new file mode 100644
index 000000000..b7ece41fc
Binary files /dev/null and b/docs/images/platform/audit-log-streams/splunk-details.png differ
diff --git a/docs/images/platform/audit-log-streams/splunk-http-collector.png b/docs/images/platform/audit-log-streams/splunk-http-collector.png
new file mode 100644
index 000000000..d8090095c
Binary files /dev/null and b/docs/images/platform/audit-log-streams/splunk-http-collector.png differ
diff --git a/docs/images/platform/audit-log-streams/splunk-name.png b/docs/images/platform/audit-log-streams/splunk-name.png
new file mode 100644
index 000000000..2c382539e
Binary files /dev/null and b/docs/images/platform/audit-log-streams/splunk-name.png differ
diff --git a/docs/images/platform/audit-log-streams/splunk-new-token.png b/docs/images/platform/audit-log-streams/splunk-new-token.png
new file mode 100644
index 000000000..d4c53569d
Binary files /dev/null and b/docs/images/platform/audit-log-streams/splunk-new-token.png differ
diff --git a/docs/images/platform/audit-log-streams/stream-create.png b/docs/images/platform/audit-log-streams/stream-create.png
index 949278e3d..1244fa558 100644
Binary files a/docs/images/platform/audit-log-streams/stream-create.png and b/docs/images/platform/audit-log-streams/stream-create.png differ
diff --git a/docs/images/platform/audit-log-streams/stream-inputs.png b/docs/images/platform/audit-log-streams/stream-inputs.png
deleted file mode 100644
index 6b9d7c57b..000000000
Binary files a/docs/images/platform/audit-log-streams/stream-inputs.png and /dev/null differ
diff --git a/docs/images/platform/audit-log-streams/stream-list.png b/docs/images/platform/audit-log-streams/stream-list.png
index c5cc5598b..ad355c3b0 100644
Binary files a/docs/images/platform/audit-log-streams/stream-list.png and b/docs/images/platform/audit-log-streams/stream-list.png differ