Overview

The CircleCI integration polls the CircleCI Audit Log API to ingest:

  • Pipeline trigger and workflow execution events
  • Project follow, unfollow, and configuration changes
  • Context, environment variable, and secret modifications
  • Member, role, and permission changes within an organization

Available on the Performance and Scale plans.

Prerequisites

  • A CircleCI organization on a plan that exposes the audit log API.
  • An account with Organization Admin permission.

Step 1: Create a personal API token in CircleCI

  1. Sign in to CircleCI.
  2. Click your avatar → Personal API Tokens.
  3. Click Create New Token, name it atatus-siem, and click Add API Token.
  4. Copy the token value immediately — it is shown only once.
  5. Note your Organization slug, which is the part after https://app.circleci.com/settings/organization/ in the URL (for example, github/my-org).

Step 2: Connect CircleCI in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the CircleCI card and click Connect.
  3. Fill in the form:
Field Description Example
API Token The personal API token from Step 1. CCIPAT_xxxxxxxxxxxxxxxx
Organization Slug VCS prefix and org name. github/my-org
Poll Interval (minutes) How often to fetch new events. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The CircleCI card shows Configured.
  • Audit events appear in Security → Cloud SIEM → Audit Logs → Events with source circleci.