Docusign Log Monitoring

Integration Overview

Docusign is the leading eSignature platform, used across organizations to manage contracts, agreements, and document workflows. Docusign Connect webhooks deliver real-time event notifications when envelopes are sent, signed, voided, or modified — giving security teams visibility into document activity as it happens. Panther ingests these webhook events through an HTTP endpoint, normalizing and storing them in a Snowflake-powered security data lake for detection and investigation.

Use Cases for Docusign Logs

Common SIEM use cases for Docusign logs include:

• Detecting unauthorized access and fraud by tracking failed authentication attempts, suspicious recipient behavior, and unexpected envelope modifications

• Monitoring template security for unauthorized creation, modification, or deletion of document templates

• Tracking administrative actions and account configuration changes for compliance and governance

Onboarding Docusign Logs in Panther

Panther's integration for Docusign is easy to configure, allowing you to onboard your log data in just a few minutes. Docusign logs are streamed to Panther in real time via a Docusign Connect webhook, using HMAC or basic authentication. Administrative privileges in your Docusign account are required to configure the webhook.

For more detailed steps on onboarding Docusign or for supported log schema, you can view our Docusign documentation here.