> ## Documentation Index
> Fetch the complete documentation index at: https://docs.manus.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Stream Manus audit events to your SIEM, or export them on demand, for compliance and security monitoring

<sup>Questions or issues? Contact us at [api-support@manus.ai](mailto:api-support@manus.ai).</sup>

# Enterprise SIEM Integrations

Export Manus agent activity as an audit feed for **compliance**, **security monitoring**, and **incident investigation**. Every step of an agent session is captured as one of four event types:

| Event         | What it records                                           |
| ------------- | --------------------------------------------------------- |
| `USER_CHAT`   | A message the user sent to the agent                      |
| `AGENT_REPLY` | A reply the agent produced (a notification or a question) |
| `TOOL_CALL`   | A tool invocation, with its arguments                     |
| `TOOL_RESULT` | The result returned by a tool                             |

## Two tiers of data

* **Tier 1 — metadata.** Identity, timing, event type, outcome, and tool/connector attributes. No message content.
* **Tier 2 — metadata + payload.** Everything in Tier 1 plus the actual content: chat text, tool-call arguments, and tool results. Requires a signed SIEM Data Processing Agreement (DPA).

## Two ways to receive it

<CardGroup cols={2}>
  <Card title="Stream (push)" icon="tower-broadcast">
    Manus pushes OpenTelemetry records to your OTLP endpoints in real time. Tier 1 destinations receive metadata; Tier 2 destinations receive metadata + payload.
  </Card>

  <Card title="Export (on demand)" icon="cloud-arrow-down">
    Run an asynchronous export over HTTP with a **SIEM** [enterprise API key](/enterprise/v2/authentication) and download an archive of the matching events.
  </Card>
</CardGroup>

Both carry the **same record schema** — see [Record format](/enterprise/v2/siem-record-format).

## Streaming (push)

Manus delivers audit events to OTLP endpoints you control. Destinations are configured in the Manus console; streaming setup uses your console sign-in, not an enterprise API key.

* **Protocols:** OTLP/HTTP and OTLP/gRPC.
* **Destination tiers:** a Tier 1 destination receives metadata-only records; a Tier 2 destination receives metadata + payload (selectable only once your enterprise has signed the SIEM DPA).
* **Endpoint auth:** attach an auth header (e.g. `Authorization: Bearer …`); Manus stores it encrypted and sends it on every push.
* **Health & control:** destinations can be paused and resumed, expose last-success / last-failure timestamps and a consecutive-failure count, and support a connection test that sends an empty OTLP request to verify reachability and auth.
* **Large payloads:** payloads above the inline limit are omitted from the Tier 2 stream; retrieve them with an export (`include_payload=true`).

## Export (on demand)

An asynchronous API authenticated with a **SIEM** enterprise API key (`X-API-Key`). You submit an export, poll until it completes, then download a ZIP archive of newline-delimited JSON (NDJSON) — one event per line.

<CardGroup cols={3}>
  <Card title="Create an export" icon="download" href="/enterprise/v2/enterprise.compliance.export.create">
    Submit an export with optional user, session, time-range, and event-type filters
  </Card>

  <Card title="Track an export" icon="hourglass" href="/enterprise/v2/enterprise.compliance.export.detail">
    Poll the task until it reaches `COMPLIANCE_EXPORT_STATUS_COMPLETED`
  </Card>

  <Card title="Download the archive" icon="link" href="/enterprise/v2/enterprise.compliance.export.downloadUrl">
    Mint a 15-minute pre-signed URL for the completed archive
  </Card>
</CardGroup>

### Export lifecycle

```
PENDING → PROCESSING → COMPLETED
                   ↘
                     FAILED
```

1. [enterprise.compliance.export.create](/enterprise/v2/enterprise.compliance.export.create) returns immediately with `COMPLIANCE_EXPORT_STATUS_PENDING`. Set `include_payload=true` to embed event payloads (Tier 2 only).
2. [enterprise.compliance.export.detail](/enterprise/v2/enterprise.compliance.export.detail) reports `PROCESSING`, then `COMPLETED` (or `FAILED`). Completed records carry `event_count` and `file_size`.
3. [enterprise.compliance.export.downloadUrl](/enterprise/v2/enterprise.compliance.export.downloadUrl) mints a 15-minute pre-signed URL for the archive.

Only one export runs at a time per enterprise; creating another while one is in progress returns `failed_precondition`.

## Operational notes

* **Prerequisite — enable SIEM capture:** Audit events become exportable once your team has at least one active SIEM destination. A Tier 1 destination captures metadata; adding a Tier 2 destination with a signed SIEM DPA also captures payloads. With no active destination, nothing is captured and exports come back empty.
* **Tenancy:** A SIEM key is scoped to your enterprise; exports only ever include events from teams your enterprise owns. Streamed records carry `tenant.team_uid` so you can route per team.
* **Retention:** Manus keeps audit events for **1 year** from each event's `occurred_at`, after which they are permanently deleted. Records already streamed to your SIEM are governed by your own retention policy.
* **Ordering:** Events in the archive are ordered newest first (`occurred_at` descending).
* **Secret redaction:** Inside tool arguments and results, values under secret-like keys (`token`, `password`, `api_key`, …) are replaced with `[REDACTED]` before any event is stored, streamed, or exported.
* **Authentication:** The export API requires a **SIEM** enterprise API key (see [Authentication](/enterprise/v2/authentication)). Streaming destinations are managed in the Manus console.