> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://zuora.ferndocs.com/docs/platform/security-and-identity/zuora-observability-connector-event-streaming-connector/event-monitoring-in-oneid/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://zuora.ferndocs.com/_mcp/server.

# Overview of Zuora Observability Connector

> Zuora Observability Connector (also known as Event Streaming Connector) in OneID streams audit events to Splunk for real-time monitoring and supports broader SIEM integrations through Zuora Audit APIs.

Zuora Observability Connector (also known as Event Streaming Connector) in OneID streams audit events to Splunk for real-time monitoring and supports broader SIEM integrations through Zuora Audit APIs.

Zuora Observability Connector (also known as Event Streaming Connector) in OneID streams audit events from Zuora systems into external monitoring tools. Built on top of the new Zuora Audit Log experience, it provides native integration with Splunk and supports broader SIEM platforms through Zuora Audit APIs.

With this connector, you can analyze real-time activity, set up alerts, and consolidate audit data across your environment.

Zuora Observability Connector includes the following capabilities:

* Stream OneID and Billing audit events directly to Splunk using the native HEC (HTTP Event Collector) integration.
* Use Zuora Audit APIs to retrieve audit events and forward them to other SIEM tools such as Datadog or Sentinel.
* Build custom pipelines to route Zuora audit data into any external monitoring system.

## Zuora Observability Connector Architecture

Event Streaming Connector serves as the high-level framework for exporting audit events. Under this framework, Zuora provides:

* Splunk Integration (native) – Streams events directly to Splunk using HEC.
* Audit Log APIs – Allows you to retrieve audit events programmatically and integrate with any third-party SIEM or logging tool.

Splunk is the only built-in integration today. If you do not use Splunk, you can use Audit APIs to connect Zuora audit events to your preferred system.

## Integrate Zuora Audit Events with Other Monitoring Tools

If you use a monitoring platform other than Splunk, you can stream events using the Audit Log APIs. These APIs allow you to:

* Retrieve audit events programmatically
* Ingest them into tools such as Datadog, Sentinel, or custom logging pipelines
* Build automated workflows for continuous event ingestion

## Supported event types

Zuora Observability Connector streams the following types of audit events:

**Login activity**

Authentication and access events.

**Settings changes**

Configuration modifications.

**Object change events**

Record-level changes across OneID and Billing.

> Zuora Observability Connector (also known as Event Streaming Connector) in OneID streams audit events to Splunk for real-time monitoring and supports broader SIEM integrations through Zuora Audit APIs.

## Docs

- [Configure event streaming and monitoring in OneID](https://zuora.ferndocs.com/docs/platform/security-and-identity/zuora-observability-connector-event-streaming-connector/event-monitoring-in-oneid/configure-splunk-integration-in-oneid.md): Learn how to configure event streaming and monitoring in OneID by setting up Splunk HEC endpoints and tokens.
- [Configure Splunk integration from Integration Hub](https://zuora.ferndocs.com/docs/platform/security-and-identity/zuora-observability-connector-event-streaming-connector/event-monitoring-in-oneid/configure-splunk-integration-from-integration-hub.md): Configure the Zuora Splunk Connector in Integration Hub to enable self-service data routing for monitoring and analytics.
- [Configure Sumo Logic integration for Observability connector](https://zuora.ferndocs.com/docs/platform/security-and-identity/zuora-observability-connector-event-streaming-connector/event-monitoring-in-oneid/configure-sumologic-integration-for-observability-coneector.md): Configure a Sumo Logic connector in OneID to send Zuora events through the Observability connector.
- [Configure Datadog integration for Observability Connector](https://zuora.ferndocs.com/docs/platform/security-and-identity/zuora-observability-connector-event-streaming-connector/event-monitoring-in-oneid/configure-datadog-integration-for-observability-connector.md): Configure a Datadog connector in OneID so that Zuora sends observability events to your Datadog account.
- [Export Audit Logs to Splunk in OneID](https://zuora.ferndocs.com/docs/platform/security-and-identity/zuora-observability-connector-event-streaming-connector/event-monitoring-in-oneid/export-audit-logs-to-splunk-in-oneid.md): Learn how to export audit logs to Splunk in OneID by configuring event streaming and monitoring.
- [Create a streaming schedule](https://zuora.ferndocs.com/docs/platform/security-and-identity/zuora-observability-connector-event-streaming-connector/event-monitoring-in-oneid/create-a-streaming-schedule.md): Create a schedule that defines which audit events Zuora pushes to a connector, how often events are sent in batches, and which tenants are included.