Zapier Log Streams Brings Real-Time Audit Events Into Enterprise SIEMs.

Security teams can now monitor changes inside Zapier without keeping a separate audit window open. The automation platform has introduced Log Streams, a capability that sends real-time Audit Log activity into the security information and event management, or SIEM, systems companies already use.

The update covers more than 45 event types across Zaps, MCP servers, app connections, Tables, variables and account administration. According to Zapier's official announcement, each event identifies who took an action, what changed and when it happened, giving analysts a more complete timeline when investigating suspicious access or an unexpected configuration change.

Zapier has divided the available events across several operational areas. Security teams can monitor the creation, publication, ownership transfer and deletion of Zaps. They can also capture approval requests, which may be relevant for organizations that apply formal controls to automation changes.

Other supported activity includes:

• MCP servers: Creation, sharing, role changes and tool updates
• App connections: Creation, sharing, reconnection, ownership changes and deletion
• Tables: Creation, sharing, imports, role changes and deletion
• Account management: Invitations, logins, permission changes and user removals
• Variables: Creation, updates, ownership changes and deletion

MCP monitoring is particularly timely as Zapier expands the role of its automation platform in agent-based workflows. The company previously introduced Zapier MCP access for AI agents across thousands of apps. Giving security teams visibility into the creation and sharing of those servers helps bring newer AI infrastructure under familiar governance processes.

Super admins and owners on Zapier Enterprise can configure a stream from Admin Center > Insights > Log streams. Administrators choose the event types they want to capture and provide the endpoint where Zapier should send the data. They can add a secret so receiving systems can verify each webhook signature before processing an event.

The practical benefit is less about collecting another set of logs and more about putting Zapier activity beside the rest of a company's security data. Teams using SIEM platforms such as Datadog or Splunk can incorporate Zapier events into dashboards, alerts and incident investigations rather than checking the automation platform separately.

Login events include IP address data, providing a starting point for investigating unexpected account access. Account events show permission changes, invitations and removals. If a Zap, Table, variable, app connection or MCP server disappears, deletion events can identify the responsible user and the time of the action.

App connections represent another important control point. Those connections determine which external systems a Zap, agent or MCP server can access. Streaming connection creation, sharing, reconnection, transfer and deletion events into a SIEM gives analysts a way to track changes in potential data flows alongside identity, infrastructure and application activity.

There are two operational caveats. Existing Log Streams do not automatically receive the newly supported events, so administrators must edit each stream and select the additional event types they need. Zapier also does not backfill historical activity. Capture begins only when a stream is created or when an event type is added, making early configuration important for organizations that need a continuous audit trail.

For smaller businesses, the feature may be more governance infrastructure than they currently require. For larger organizations building critical processes and AI-agent workflows on Zapier, however, it closes a notable monitoring gap by bringing automation changes into established security operations.

What is Zapier Log Streams?

Zapier Log Streams is an Enterprise capability that sends real-time Zapier Audit Log events to an endpoint connected to a company's SIEM. It covers more than 45 event types and records who performed an action, what changed and when it occurred.

Who can configure Log Streams?

Super admins and owners on Zapier Enterprise can create or edit a Log Stream in Admin Center under Insights and Log streams. Zapier's announcement does not state that the feature is available on other plans.

Do Log Streams include historical events?

No. Event capture begins when an administrator creates the stream or adds a selected event type. Existing streams must be edited to include the new events, and Zapier does not provide a backfill for earlier activity.