Hi community,We are comparing the Box Events API endpoints for enterprise event logging and noticing a timing gap between admin_logs and admin_logs_streaming.The official documentation mentions: admin_logs: Returns historical events strictly in chronological order with higher latency. admin_logs_streaming: Delivers events for live polling with much lower latency, but potentially out of order and with duplicates. For those running this in production: What average latency or time delay are you seeing on admin_logs before an event appears compared to admin_logs_streaming? How are you handling the latency gap when syncing live audit data into your SIEM or monitoring pipeline? Thanks for sharing your insights!

Question

What is the typical time difference/latency between admin_logs and admin_logs_streaming?

Hi community,

We are comparing the Box Events API endpoints for enterprise event logging and noticing a timing gap between admin_logs and admin_logs_streaming.

The official documentation mentions:

admin_logs: Returns historical events strictly in chronological order with higher latency.
admin_logs_streaming: Delivers events for live polling with much lower latency, but potentially out of order and with duplicates.

For those running this in production:

What average latency or time delay are you seeing on admin_logs before an event appears compared to admin_logs_streaming?
How are you handling the latency gap when syncing live audit data into your SIEM or monitoring pipeline?

Thanks for sharing your insights!