When your security team investigates suspicious access or an unexpected configuration change, they need the full timeline in one place. They should be able to see when someone logged in, shared an app connection, changed a Zap, or created an MCP server alongside activity from the rest of your stack.
Log Streams can now send Zapier Audit Log activity into the SIEM your team already monitors. It's got more than 45 event types that cover admin and configuration changes across Zaps, MCP servers, app connections, variables, account management, and Tables. And each event records who acted, what they changed, and when it happened.
Choose the activity your security team needs
Super admins and owners on Zapier Enterprise can create a Log Stream or edit an existing one in Admin Center > Insights > Log streams.
When you configure the stream, just pick the events your team wants to see, like:
Zaps: Creation, publishing, ownership changes, approval requests, and deletion
MCP servers: Creation, sharing, role changes, and tool updates
App connections: Creation, sharing, reconnection, ownership changes, and deletion
Tables: Creation, sharing, imports, role changes, and deletion
Account management: Member invitations, logins, permission changes, and removals
Variables: Creation, updates, ownership changes, and deletion
Zapier sends that data to the endpoint you choose. You can also add a secret and verify each webhook signature before your systems process the event.
Heads up: Existing streams don't add the new events automatically, so you'll need to edit your streams and add the events you want. Capture starts when you create the stream or add an event type; there's is no backfill.
Here are some ways Log Streams help your team stay on top of issues.
Investigate suspicious access
Login events include IP address data that can help your security team spot unexpected access. Account events also show when someone changes permissions, adds a member, or removes a user.
Events give your team a starting point for tracing issues, like who logged in, what changed, and which Zapier assets were affected.
See when app connections change
App connections show which systems a Zap, agent, or MCP server can reach. Log Streams can tell your SIEM when someone creates, shares, reconnects, transfers, or deletes a connection. That way, your team can track data flow without checking Zapier separately.
Trace destructive changes
Delete events cover Zaps, Tables, app connections, variables, and MCP servers. If assets disappear and you're not sure why, your team can identify what was removed, who performed the action, and when it happened.
Put Zapier activity beside the rest of your security data
Your team already uses tools such as Datadog or Splunk to monitor activity across the company. Log Streams brings Zapier execution, admin, and configuration events into that same workflow, so analysts can build dashboards, alerts, and investigation timelines with the tools they already run.
Log Streams is available on Zapier Enterprise. A super admin or owner can set up a Log Stream in Admin Center.
