Announcing access log webhooks for SIEM integration

<figure class="wysiwyg-table" style="height: 44px; width: 100%;"><table class="wysiwyg-table-resized" style="border-collapse: collapse; margin-left: 0px; margin-right: auto;">
<colgroup>
<col style="width: 50%;">
<col style="width: 50%;">
</colgroup>
<tbody>
<tr style="height: 22px;">
<td style="height: 22px; width: 33.3333%;"><strong>Announced on</strong></td>
<td><strong>Rollout on</strong></td>
</tr>
<tr style="height: 22px;">
<td style="height: 22px; width: 33.3333%;">August 13, 2026</td>
<td>August 13, 2026</td>
</tr>
</tbody>
</table></figure><p>Zendesk is releasing access log webhooks to make security information and event management (SIEM) integration easier. This feature is available exclusively for customers who have purchased the <a href="https://support.zendesk.com/hc/en-us/articles/6561144266906" target="_blank" rel="noopener noreferrer">Advanced Data Privacy and Protection (ADPP) add-on</a>.</p><p>This article includes the following sections:</p><ul>
<li data-list-item-id="eb35f95c5cfdc55c27503e4c25d937f9b"><a href="#h_01K39FKN2ZKQS92V5424YQV505">What's changing?</a></li>
<li data-list-item-id="e52cb53b1a9154a3d655b7a790709e304"><a href="#h_01K3A7DY1MGYWC5Z9FE5WEZMD9">Why is Zendesk making this change?</a></li>
<li data-list-item-id="ef6c21e18f5295fa85562864325429ad9"><a href="#h_01K3A7FEPQBH8P3JPGKNBZRT8C">What do I need to do?</a></li>
</ul><h2 id="h_01K39FKN2ZKQS92V5424YQV505">What's changing?</h2><p>Zendesk is introducing access log webhooks, giving admins a way to receive access log events in near real time at a customer-configured HTTPS endpoint. This expands how access logs can be delivered, adding an event-driven option that fits directly into existing security workflows, including SIEM platforms such as Splunk, Datadog, Microsoft Sentinel, and QRadar.</p><p>Updates include:</p><ul>
<li data-list-item-id="e2e34814a46cce1ae1738736d3a8a0747">
<strong>Webhook subscriptions (Admin Center)</strong>: Admins can create and manage access log webhook subscriptions, including the destination URL and authentication configuration.</li>
<li data-list-item-id="e908a337206c989eba24f9b2512cb0803">
<strong>Near real-time delivery</strong>: Access log events are pushed to the configured endpoint as they occur, instead of requiring customers to build and run their own polling collectors.</li>
<li data-list-item-id="e0350ab0827ef551cf62a9551e33214a6">
<strong>Batching</strong>: Delivery includes batching to handle traffic spikes and avoid overloading customer endpoints.</li>
<li data-list-item-id="eeb92c42a43f8f53804e109a5a982c2b9">
<strong>Retries and backoff</strong>: Transient delivery failures are automatically retried with backoff to reduce missed events.</li>
<li data-list-item-id="e9702e4665577a8b481c446375bedf10f">
<strong>Delivery receipts</strong>: By default, delivery receipts are recorded only for failed deliveries.</li>
</ul><p>These improvements reduce the effort required to integrate access logs into a customer's security tooling, while helping security and compliance teams detect and respond to activity faster.</p><h2 id="h_01K3A7DY1MGYWC5Z9FE5WEZMD9">Why is Zendesk making this change?</h2><p>Zendesk is introducing access log webhooks to remove a significant adoption blocker for security- and compliance-mature customers who rely on a SIEM for monitoring. Today, customers must build and maintain their own polling collectors to pull access log data into their SIEM, which is slow, reactive, and adds ongoing operational overhead.</p><p>Access log webhooks give customers a vendor-agnostic, near real-time delivery path that works with the SIEM platform they already use, without requiring Zendesk to build and maintain a native connector for every vendor. This allows for faster incident response and lowers the operational burden of keeping access log data in sync with existing security tooling.</p><h2 id="h_01K3A7FEPQBH8P3JPGKNBZRT8C">What do I need to do?</h2><p>No action is required to continue using access logs as-is; access log webhooks are an opt-in capability. To start using them, admins with the Advanced Data Privacy and Protection (ADPP) add-on with access logs enabled can create a webhook subscription in Admin Center by providing a destination URL and authentication details.</p><p>See the following resources for more information:</p><ul>
<li data-list-item-id="e761dd15324e27a9a24867fb80ecea02c">To learn more about access logs, see <a href="https://support.zendesk.com/hc/en-us/articles/6066010357530" target="_blank" rel="noopener noreferrer">Using the access log to monitor agent activity</a>.</li>
<li data-list-item-id="e2364eddaff302b5d6bc1191bff8f336f">For more information on creating webhooks in Zendesk, see <a href="https://support.zendesk.com/hc/en-us/articles/4408839108378" target="_blank" rel="noopener noreferrer">Creating webhooks to interact with third-party systems</a>.</li>
<li data-list-item-id="e8983d6e4d2b661a8490b9326aa4b2fbc">For a description of the access log event data sent to your webhook endpoint, see <a href="https://developer.zendesk.com/api-reference/webhooks/event-types/access-log-events?_gl=1*1s4cdgy*_ga*MTYzOTY3NjY3Mi4xNzc1NTgwMzEy*_ga_0G6FC9CS2V*czE3ODY2MzU0NzgkbzMwOSRnMSR0MTc4NjYzNzYzMCRqNjAkbDAkaDA." target="_blank" rel="noopener noreferrer">Access log events</a> in the developer docs.</li>
</ul><p>If you have feedback or questions related to this announcement, visit our <a href="https://community.zendesk.com/ideas" target="_blank" rel="noopener noreferrer"><span class="wysiwyg-underline">community forum</span></a> where we collect and manage customer product feedback. For general assistance with your Zendesk products, contact <a href="https://support.zendesk.com/hc/en-us/articles/4408843597850" target="_blank" rel="noopener noreferrer"><span class="wysiwyg-underline">Zendesk Customer Support</span></a>.<br><br> </p>