Atlas Log Push SIEM
Parent: MongoDB Atlas IAM and RBAC · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-1525e6d34833
↓ Facts as markdownall context files
Source-anchored research for Atlas Log Push SIEM. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Structure and components
- Atlas requires TLS and publicly trusted certificates for its external Splunk endpoint; self-signed certificates are unsupported. Exported logs can contain PII, so the destination owner must control storage and handling. (low confidence) (verified as of 2026-10-23) [source]
How it works
- A demonstrated SIEM architecture sends Atlas engine logs to S3 and lets Wazuh or Elastic retrieve them. Elastic's walkthrough uses its Custom AWS Logs integration because Atlas does not expose the server log path to a local file collector. (high confidence) [source]
How-to and procedures
- Enable and filter database auditing, then verify delivery at the SIEM destination. Export configuration alone does not establish that relevant audit events arrive. (medium confidence) [source]
Problems, failure modes and limitations
- MongoDB marks legacy Push-Based Log Export deprecated from February 4, 2026, blocks new configurations after October 30, 2026, and sets end of life at February 4, 2027. Existing configurations may continue until coordinated retirement; end of life is not a guaranteed immediate shutdown. (high confidence) (verified as of 2026-10-23) [source]
- The legacy pushBasedLogExport S3 feature exports every five minutes and cannot select individual log types. Its replacement uses logIntegrations, offers one-minute intervals and per-destination log selection, and supports additional destinations. (high confidence) (verified as of 2026-10-23) [source]
- Event export is at least once, normally flushes batches about once per minute, and buffers undelivered events for up to seven days. The initial release has no automatic replay, historical backfill, or failure alerts. System-log export separately documents default failure alerts; do not assume those guarantees apply to events. (medium confidence) (verified as of 2026-10-14) [source]
Facts and statements
- Atlas external log integrations export mongod, mongos, and their audit logs to destinations including Splunk and cloud storage; MongoDB also documents OpenTelemetry-compatible destinations. Centralizing these records supports investigation of database authentication, authorization, and role changes. (high confidence) (verified as of 2026-10-23) [source]
- The legacy Push-Based Log Export sends all mongod, mongos, and audit logs to S3 every five minutes; it does not offer per-log-type selection or BYOK. (low confidence) (verified as of 2026-10-14) [source]
- Migration replaces /pushBasedLogExport with /logIntegrations. MongoDB recommends validating the replacement while both exports run, expecting duplicates, then disabling the legacy export; useLegacyPathStructure preserves the old daily-folder layout. (low confidence) (verified as of 2026-10-14) [source]
- Elastic recommends S3 object notifications through SQS over polling every object, and notes that custom field mapping may be needed before validating imported logs in Kibana. (low confidence) [source]
- Native Splunk export requires M10+ on MongoDB 7.0 or later, Atlas Project Owner or Organization Owner access, and a Splunk HEC endpoint with an ingestion token. It sends selected engine/audit logs every minute. (low confidence) (verified as of 2026-10-14) [source]
- Delivery pipelines must tolerate duplicate entries caused by network failures or retries; both MongoDB's Splunk documentation and Wazuh's S3 walkthrough warn about this behavior. (high confidence) [source]
- Wazuh's May 28, 2026 example collects management-plane events separately through the Atlas API alongside S3 engine logs. Current Atlas Splunk documentation also offers Activity Feed Events; API polling is therefore a demonstrated approach, not the only possible management-event route. (medium confidence) (verified as of 2026-10-14) [source]
- Database audit logs and Atlas management events cover different activity. A SIEM collection plan should include both: engine logs capture database activity, while Activity Feed events capture platform administration such as access-list and database-user changes. (high confidence) [source]
- Activity Feed export supports project events to Splunk, Datadog, S3, Azure Blob Storage, Google Cloud Storage, and OTel. Initial organization event export supports only OTel. Event export does not require an M10+ cluster; project and organization configuration require their respective Owner roles. (low confidence) (verified as of 2026-10-14) [source]
- Activity Feed export uses logTypes including EVENTS. Organization log-integration API endpoints require the preview Accept header. Event records expose mongodb.event.id for deduplication and service.name=mongodb-atlas-events for routing. (low confidence) (verified as of 2026-10-14) [source]
- Wazuh’s May 28, 2026 example combines S3 engine-log collection with management-event API polling every five minutes. It grants its management collector Organization Read Only plus explicit Project Read Only access. This is an implementation example, not proof that native event push is unavailable. (medium confidence) (verified as of 2026-05-28) [source]
- Splunk also documents an API-based MongoDB Atlas receiver for its OpenTelemetry Collector. Its example enables host and audit logs, adds the receiver to the logs pipeline, and uses an API key with Project Data Access Read Only or higher. This pull collector is distinct from Atlas pushing to Splunk HEC. (medium confidence) (verified as of 2026-05-04) [source]
Children
- Atlas external log integration migration (frontier)
- Atlas Activity Feed export (frontier)
- SIEM log deduplication (frontier)
Frontier under this node: Atlas Activity Feed export, Atlas external log integration migration, SIEM log deduplication