Hosting and infrastructure
Activity log export for SIEM
The activity log as an authenticated NDJSON feed, so security events can be pulled into whatever monitoring stack your IT team already runs.
Available, configured at deployment
Schools with an IT function that already runs log aggregation should not have to read a second console. The activity log is available as a newline-delimited JSON feed behind a shared secret, which is the format most log pipelines ingest without transformation.
The practical use is retention and correlation. A school that keeps twelve months of platform activity alongside its network and endpoint logs can answer a question about who accessed what without depending on how long the application retains its own log.
There is also a generic error webhook, which posts application errors to a URL you nominate. Between the two, an operator can route Schoolyi into existing monitoring without a vendor-specific integration.
How it works
- The activity log endpoint serves NDJSON, authenticated by a shared secret set at deployment.
- A separate error webhook posts application errors as JSON to an operator-nominated URL, signed with its own secret.
- Both are pull or push against your own infrastructure. There is no third-party SIEM vendor in the path.
Who configures it
Both the export secret and the error webhook URL and secret are deployment environment variables, set by whoever operates the server.
What it does not do
Worth reading before a procurement decision rather than after.
- There is no vendor-specific integration for Splunk, Datadog, Sentry, or any other monitoring product. These are generic feeds your pipeline consumes.
- The export is for operators, not a school administrator feature. It is not exposed in the application UI.
- Retention beyond the platform’s own is your pipeline’s responsibility, which is the point of exporting.
Related
Activity log export for SIEM: common questions
Including the questions where the answer is no.
Does this work with our SIEM?+
If your SIEM ingests NDJSON over an authenticated HTTP endpoint — most do — then yes, without a connector. We deliberately did not build vendor-specific integrations, because a generic feed works with the tool you already chose.
What is in the activity log?+
Platform activity events suitable for security correlation and access review. If a specific event type matters to your audit requirement, raise it during evaluation so you can confirm it is captured rather than assuming.
Who can enable this?+
Whoever operates the deployment, through environment configuration. It is intentionally not a setting a school administrator can toggle, since it exposes a log feed.
Everything else
Other integrations, and the ones we do not have
The hub lists what is available and names what is not.
Bring your stack to a walkthrough
Tell us what you already run and which handoffs cost your team time. That is a more useful conversation than a compatibility list.
Already using Schoolyi? Sign in