diff --git a/ScalliGraph b/ScalliGraph
index 5b48cd7508..a6637cd432 160000
--- a/ScalliGraph
+++ b/ScalliGraph
@@ -1 +1 @@
-Subproject commit 5b48cd75080a17ba0986ddcc7c572a96de86ddaa
+Subproject commit a6637cd4321973ec49f8f83df0397e3d7ec3c9af
diff --git a/thehive/app/org/thp/thehive/controllers/v0/StreamCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/StreamCtrl.scala
index bfb4899386..d3281d63f5 100644
--- a/thehive/app/org/thp/thehive/controllers/v0/StreamCtrl.scala
+++ b/thehive/app/org/thp/thehive/controllers/v0/StreamCtrl.scala
@@ -2,6 +2,7 @@ package org.thp.thehive.controllers.v0
 
 import javax.inject.{Inject, Named, Singleton}
 import org.apache.tinkerpop.gremlin.process.traversal.Order
+import org.thp.scalligraph.auth.{ExpirationStatus, SessionAuthSrv}
 import org.thp.scalligraph.controllers.Entrypoint
 import org.thp.scalligraph.models.{Database, Schema}
 import org.thp.scalligraph.traversal.TraversalOps._
@@ -11,7 +12,7 @@ import org.thp.thehive.services._
 import play.api.libs.json.{JsArray, JsObject, Json}
 import play.api.mvc.{Action, AnyContent, Results}
 
-import scala.concurrent.ExecutionContext
+import scala.concurrent.{ExecutionContext, Future}
 import scala.util.Success
 
 @Singleton
@@ -35,43 +36,49 @@ class StreamCtrl @Inject() (
       }
 
   def get(streamId: String): Action[AnyContent] =
-    entrypoint("get stream").async { _ =>
-      streamSrv
-        .get(streamId)
-        .map {
-          case auditIds if auditIds.nonEmpty =>
-            db.roTransaction { implicit graph =>
-              val audits = auditSrv
-                .getMainByIds(Order.desc, auditIds: _*)
-                .richAuditWithCustomRenderer(auditRenderer)
-                .toIterator
-                .map {
-                  case (audit, obj) =>
-                    audit
-                      .toJson
-                      .as[JsObject]
-                      .deepMerge(
-                        Json.obj(
-                          "base"    -> Json.obj("object" -> obj, "rootId" -> audit.context._id),
-                          "summary" -> jsonSummary(auditSrv, audit.requestId)
+    entrypoint("get stream").async { request =>
+      if (SessionAuthSrv.isExpired(request))
+        Future.successful(Results.Unauthorized)
+      else
+        streamSrv
+          .get(streamId)
+          .map {
+            case auditIds if auditIds.nonEmpty =>
+              db.roTransaction { implicit graph =>
+                val audits = auditSrv
+                  .getMainByIds(Order.desc, auditIds: _*)
+                  .richAuditWithCustomRenderer(auditRenderer)
+                  .toIterator
+                  .map {
+                    case (audit, obj) =>
+                      audit
+                        .toJson
+                        .as[JsObject]
+                        .deepMerge(
+                          Json.obj(
+                            "base"    -> Json.obj("object" -> obj, "rootId" -> audit.context._id),
+                            "summary" -> jsonSummary(auditSrv, audit.requestId)
+                          )
                         )
-                      )
-                }
-              Results.Ok(JsArray(audits.toSeq))
-            }
-          case _ => Results.Ok(JsArray.empty)
-        }
+                  }
+                if (SessionAuthSrv.isWarning(request))
+                  new Results.Status(220)(JsArray(audits.toSeq))
+                else
+                  Results.Ok(JsArray(audits.toSeq))
+              }
+            case _ if SessionAuthSrv.isWarning(request) => new Results.Status(220)(JsArray.empty)
+            case _                                      => Results.Ok(JsArray.empty)
+          }
     }
 
-  def status: Action[AnyContent] = // TODO
-    entrypoint("get stream") { _ =>
-      Success(
-        Results.Ok(
-          Json.obj(
-            "remaining" -> 3600,
-            "warning"   -> false
-          )
-        )
-      )
+  def status: Action[AnyContent] =
+    entrypoint("get stream") { request =>
+      val status = SessionAuthSrv.expirationStatus(request) match {
+        case Some(ExpirationStatus.Ok(remaining))      => Json.obj("warning" -> false, "remaining" -> remaining.toMillis)
+        case Some(ExpirationStatus.Warning(remaining)) => Json.obj("warning" -> true, "remaining" -> remaining.toMillis)
+        case Some(ExpirationStatus.Error)              => Json.obj("warning" -> true, "remaining" -> 0)
+        case None                                      => Json.obj("warning" -> false, "remaining" -> 1)
+      }
+      Success(Results.Ok(status))
     }
 }