Agent egress logs SIEM integration means shipping every outbound call an AI agent makes (destination host, tool name, arguments, identity, policy verdict, and byte counts) from your egress proxy into Splunk, Datadog, or Microsoft Sentinel as structured events, so detection rules and audit evidence run on the agent's actions rather than its tokens.
Most teams already stream LLM telemetry: prompt text, token counts, latency, cost. That tells you what the model said. It does not tell you that the agent resolved an unfamiliar domain, POSTed 40KB to a pastebin, or hit 169.254.169.254 after reading a poisoned document. Those events only exist on the wire. If your proxy sees them and your SIEM never does, you have monitoring without detection.
What agent egress logs SIEM integration actually covers
An agent egress log is one event per outbound connection attempt, emitted from the enforcement point (a forward proxy, MCP gateway, or sidecar) rather than from inside the agent process. That placement matters for three reasons:
- It survives compromise of the agent. A prompt-injected agent can suppress its own tracing calls. It cannot suppress a log written outside its trust boundary.
- It records denied actions. In-app instrumentation usually logs what succeeded. Denials, escalations, and timeouts are the highest-signal events for a SIEM.
- It is protocol-complete. HTTP, HTTPS via CONNECT, MCP tool calls, WebSocket upgrades, and DNS lookups all land in one normalized stream.
Agent G emits these events out of band as newline-delimited JSON, with optional hash chaining so each record references the digest of the previous one. That property is what turns operational logs into defensible evidence, a pattern covered in depth in action receipts as verifiable audit evidence.
The event schema your detections need
Before you pick a transport, fix the schema. Renaming fields after you have 90 days of data in an index is painful, and every downstream saved search breaks. The minimum viable field set for agent egress looks like this.
| Field | Example value | Why the SIEM needs it |
|---|---|---|
event.id | 01HX9K2Q4S | Deduplication across retries and buffered replays. |
agent.id | svc-invoice-agent | Per-identity baselining; the primary pivot field. |
agent.run_id | run_8812 | Reconstructs one autonomous run as a single incident timeline. |
dest.host / dest.port | api.stripe.com / 443 | Allowlist drift, rare-domain and new-domain detections. |
http.method / http.path | POST / v1/transfers | Separates reads from state-changing writes. |
tool.name / tool.args_digest | send_email / sha256:9f2a... | Ties a network call to the MCP tool that caused it without storing raw arguments. |
policy.id / policy.version | egress-default-deny / 14 | Proves which rule version was in force at execution time. |
verdict | allow, deny, escalate, approved, expired | The single most valuable field for alerting. |
approval.actor / approval.latency_ms | alice@corp / 43120 | Human oversight evidence for auditors. |
bytes.out / bytes.in | 41219 / 512 | Volumetric exfiltration detection. |
dlp.findings | [aws_access_key, email_pii] | Classifier hits, with the matched value redacted. |
chain.prev_hash | sha256:4c1b... | Tamper evidence for the log sequence itself. |
Map this once to a normalized model (OCSF Network Activity or ECS work well) and every platform below becomes a formatting exercise rather than a modeling exercise.
Five steps to stream agent logs to Splunk, Datadog, or Sentinel
- Enable structured egress logging at the proxy. Turn on JSON output, set the redaction policy for request bodies, and confirm that denied and escalated events are emitted, not just allowed ones.
- Choose a decoupled buffer. Write to a local file or Unix socket, then let a shipper (Splunk Universal Forwarder, the Datadog Agent, Fluent Bit, or Vector) handle retries. Never make an outbound agent request wait on your SIEM's availability.
- Decide the backpressure behavior explicitly. If the log sink is unreachable, does the proxy keep enforcing and spool to disk, or does it fail closed? For regulated workloads, fail closed on log loss for high-risk destinations and spool for everything else.
- Normalize field names at the shipper, not the source. Keep the proxy schema stable and do per-vendor renaming in the pipeline so you can add a second SIEM later without touching enforcement config.
- Ship detections with the integration. An index with no saved searches is a compliance artifact, not a control. Deploy the four rules in the next section on day one.
Agent logs to Splunk via HEC
Send events to the HTTP Event Collector with a dedicated sourcetype such as agentg:egress and an index that matches your security retention tier. Use INDEXED_EXTRACTIONS = json and pin TIME_PREFIX to the proxy timestamp rather than the ingest time, otherwise a spooled replay after an outage will bunch thousands of events into one minute and wreck your baselines. Set SHOULD_LINEMERGE = false for newline-delimited JSON. Because verdict and agent.id are low-cardinality, they make excellent accelerated fields for data model summaries.
Agent logs to Datadog
The Datadog Agent tailing a log file is the least brittle path; the Logs Intake API is fine for serverless proxies where no agent runs. Tag events with service:agentg, env, and agent_id so the tags survive into monitors and dashboards. Add a log-to-metric rule that counts @verdict:deny by @agent.id, then monitor the metric instead of the raw logs. That keeps alerting cheap and lets you retain full events at a lower index rate. A single timeboard with denies by agent, top destination hosts, DLP findings, and approval latency percentiles covers most on-call needs.
AI agent logs in Microsoft Sentinel
For Sentinel, use the Logs Ingestion API with a Data Collection Rule and a Data Collection Endpoint, targeting a custom table such as AgentEgress_CL. Define the DCR transform to project only the schema fields you care about; dropping raw headers at ingest is both a cost and a privacy win. Sentinel appends type suffixes to custom columns, so plan for Verdict_s, DestHost_s, and BytesOut_d in your KQL. Map agent.id into an entity so incidents pivot on the non-human identity the same way they pivot on a user account.
Four detection rules worth deploying immediately
- Denial burst per identity. An agent hammering blocked destinations is either misconfigured or probing. In Splunk:
index=agent_egress verdict=deny | stats dc(dest.host) as hosts count by agent.id | where count > 20 OR hosts > 5. - First-seen destination for a known agent. Compare the last hour of
dest.hostvalues against a 14 day lookup of that agent's normal set. New domains are the earliest signal of tool poisoning or hallucinated dependencies. - Volumetric egress on a write path. Alert when
bytes.outfor a single agent exceeds its rolling p99, especially on POST or PUT to messaging, storage, or paste destinations. In Sentinel:AgentEgress_CL | where HttpMethod_s == 'POST' | summarize sum(BytesOut_d) by AgentId_s, bin(TimeGenerated, 5m). - Escalations that expire without a human decision. High counts of
verdict=expiredmean your approval workflow is a throughput problem, and engineers will start routing around it. This is an operational metric that becomes a security metric fast.
Pair the first two with DNS-layer visibility, since low-and-slow lookups can carry data out under the radar of HTTP-only rules. See DNS exfiltration for AI agents for the query patterns.
Volume, cost, and redaction
A single autonomous run can produce dozens of outbound calls, and a fleet of coding agents in CI can produce thousands per hour. Three levers keep ingest sane without blinding your detections:
- Digest, do not dump. Store a hash of tool arguments and request bodies plus classifier labels. Keep raw payload capture behind a policy flag for high-risk destinations only.
- Tier retention. Denials, escalations, approvals, and DLP hits go to your searchable security index. Routine allowed calls to already-approved hosts can roll to cheap archive storage where they remain available for audit and forensics.
- Redact before egress of the log itself. If a request body contained PHI or a token, the log must carry the finding type and offset, never the value. Otherwise your SIEM becomes the largest copy of the data you were trying to protect.
Platform teams operationalizing this as shared infrastructure will find the deployment topology, sizing, and rollout sequence in the platform engineer's guide to agent egress.
Frequently Asked Questions
Why not use my LLM observability tool instead of a SIEM?
Observability tools trace prompts, tokens, and latency inside the application. They rarely record blocked network calls, tool arguments at the wire, or policy versions. Agent egress logs SIEM integration adds the action layer your detection engineers can alert on and your auditors can accept as evidence.
Will streaming egress logs add latency to agent calls?
It should not. Agent G writes log events out of band to a local buffer while the enforcement decision happens inline, so shipping to Splunk, Datadog, or Sentinel never sits in the request path. Configure spooling and backpressure so a SIEM outage degrades logging, not enforcement.
How do I correlate an egress event back to a specific agent run?
Propagate a run identifier and agent identity into every outbound request through headers or MCP session metadata, then index agent.run_id and agent.id. One search on the run ID reconstructs the full chronological sequence of allowed, denied, and approved actions.
Which fields matter most for compliance evidence?
Timestamp, agent identity, destination, verdict, policy ID with version, and the approving human plus approval latency. Together they demonstrate that a control existed, applied to a specific action, and produced a recorded decision, which is exactly what auditors ask for.
Bring your agent actions into the tools you already watch
Agent egress logs SIEM integration is the difference between believing your agents behaved and being able to prove it. Agent G enforces default-deny egress, inspects MCP tool arguments through its MCP gateway, gates risky actions for human approval, and streams every decision as a normalized, hash-chained event to Splunk, Datadog, or Microsoft Sentinel. Learn how the enforcement layer works on the Agent G overview, or compare approaches in our 2026 buyer's guide.
Ready to see your agents' outbound actions in your own SIEM? Request access to the Agent G private beta and get the schema, shipper configs, and starter detection rules with your deployment.