Connect OTLP/HTTP exporters or Vercel Log Drains from Infrastructure. Security-one reviews accepted logs, retrieves scoped context, and correlates activity across related sources. Escalation automatically uses all enabled webhooks subscribed to infrastructure incidents under Webhooks.

The Sources view guides first-time setup: connect a source and receive its first log batch, then add an enabled webhook subscribed to infrastructure incident escalation. No additional destination selection is needed. The checklist collapses when both steps are complete and can be expanded again.

See Infrastructure log sources for setup, coverage, limits, and notification controls.