# Exporting Audit Logs In addition to [viewing audit logs in the OX platform](https://docs.ox.security/admin-settings/audit-logs), you can export audit logs to an external Amazon S3 bucket. Audit logs are written to the S3 bucket using a structured folder hierarchy that is created automatically by OX. Audit log export is typically used when you need to perform the following: * **Centralized logging:** Consume audit logs using existing log processing pipelines. * **Compliance and retention:** Store audit logs in customer-managed, long-term storage. * **Automation:** Enable automated analysis outside the OX platform. ## How audit log export works Audit logs are exported as JSON files to a customer-managed S3 bucket. Each export includes all audit log events generated since the previous export. If no user or system activity occurred during the export window, the exported file still contains a system-generated event indicating that the export ran successfully. Audit log export uses an AWS role-based connector. During the setup, OX generates a unique external ID and uses an AWS IAM role, which is created in AWS with permission to write to the specified S3 bucket. The role ARN and external ID are used together to securely authenticate export operations. ## Prerequisites * OX admin permissions * AWS admin account with permissions to add an IAM role ## Step 1: Generating an AWS IAM role \[AWS] 1. In OX, go to **Connectors**, and search for **S3 Audit Log Exporter**.

2. Select **CLOUD FORMATION ASSUME ROLE**.

You are redirected to the **Quick create stack** page.

3. In the **Quick create stack** page, set the following parameters:

Setting	Description
Stack name	Provide a unique stack name.
S3 Bucket Name	The Amazon S3 bucket where audit logs are exported: Amazon S3 > Buckets > your S3 bucket name.
S3 bucket prefix	Optional, folder inside the bucket where audit logs are stored. This allows working with separate folders, and is useful if you want to grant permissions to a specific folder only.

4. Select **I acknowledge that AWS CloudFormation might create IAM resources with custom names**. 5. Select **Create stack**. The new stack appears in **Outputs**.

6. Save the value **RoleArn** in a safe location for later use in OX. ## Step 2: Connecting to S3 Audit Logs Exporter \[OX] 1. In OX, go to **Connectors > S3 Audit Log Exporter**.

Setting	Description
AWS External ID	A unique ID automatically provided by OX.
AWS Role ARN	The RoleArn value you saved in Step 1.

2. Select **CONNECT**. ## Step 3: Configure Audit Log Export Settings \[OX] 1. Go to **Settings > Audit Logs**.

Setting	Description
S3 Bucket Name	The Amazon S3 bucket where audit logs are exported: Amazon S3 > Buckets > your S3 bucket name.
S3 region	The AWS region where the bucket is located. Check in the S3 bucket, in the Properties tab.
S3 bucket prefix (optional)	Defines the folder in the bucket where audit logs are written. If a prefix is specified, OX stores the exported logs under that folder; if it is left empty, logs can be written anywhere in the bucket based on the permissions granted to the role. When a prefix is provided, OX creates the folder and automatically generates the internal subfolder structure used to store the audit log files.
Export Frequency	Determines how often audit logs are written to the S3 bucket and can be set from 1 to 24 hours. The first export runs at the beginning of the next full hour after configuration is saved, and each export includes all audit log events generated since the previous export. If no activity occurs during the interval, the exported file still contains a system entry confirming that the export completed successfully. Default: 1 hour.

2. Select **VERIFY CONNECTIVITY** and then select **SAVE**. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.ox.security/admin-settings/audit-logs/exporting-audit-logs.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.