CircleCI - Atatus Docs

Overview

The CircleCI integration polls the CircleCI Audit Log API to ingest:

Pipeline trigger and workflow execution events
Project follow, unfollow, and configuration changes
Context, environment variable, and secret modifications
Member, role, and permission changes within an organization

Available on the Performance and Scale plans.

Prerequisites

A CircleCI organization on a plan that exposes the audit log API.
An account with Organization Admin permission.

Step 1: Create a personal API token in CircleCI

Sign in to CircleCI.
Click your avatar → Personal API Tokens.
Click Create New Token, name it atatus-siem, and click Add API Token.
Copy the token value immediately, because it is shown only once.
Note your Organization slug, which is the part after https://app.circleci.com/settings/organization/ in the URL (for example, github/my-org).

Step 2: Connect CircleCI in Atatus

In Atatus, go to Security → Cloud SIEM → Integrations.
Locate the CircleCI card and click Connect.
Fill in the form:

Field	Description	Example
API Token	The personal API token from Step 1.	`CCIPAT_xxxxxxxxxxxxxxxx`
Organization Slug	VCS prefix and org name.	`github/my-org`
Poll Interval (minutes)	How often to fetch new events.	`5`
Enabled	Turn collection on.	`true`

Click Connect.

Verification

The CircleCI card shows Configured.
Audit events appear in Security → Cloud SIEM → Audit Logs → Events with source circleci.