Skip to main content

Configure audit log export via API for integration with any SIEM system

For your information

This guide provides instructions for configuring audit log export via the Audit Logs API to your SIEM system. You need to configure settings on the SIEM system side on your own following its official documentation. To integrate with RuSIEM and Wazuh systems, use the instructions Set up integration with the RuSIEM SIEM system and Set up integration with the Wazuh SIEM system.

  1. Create a service user.
  2. Get an IAM token for the account.
  3. Get the script for exporting audit logs.
  4. Configure and run the script.
  5. Set up log ingestion in the SIEM system.

1. Create a service user

Add a service user with the audit_logs.admin role.

Users can be added by the Account Owner or users with the iam.admin role.

2. Get an account IAM token

Get an account-scoped IAM token for the service user you created in step 1.

3. Get the script for exporting audit logs to a SIEM system

We have prepared a script for exporting audit logs — it allows you to export logs to a file, as well as send them to a specified IP address or endpoint via syslog or HTTP/HTTPS.

  1. Open the CLI.

  2. Clone the script repository:

    git clone https://github.com/t-rex-general/auditlog-integration.git

    The script files will be saved to the working directory in the auditlog-integration folder.

4. Configure and run the script

The script allows you to receive logs in several ways:

  • upload to a file;
  • send to an IP address via the syslog protocol;
  • send to an endpoint via the HTTP/HTTPS protocol.

Configure the script depending on the required log collection method:

  1. Open the CLI.

  2. Create a virtual environment:

    python3 -m venv .venv

  3. Activate the virtual environment:

    source .venv/bin/activate

  4. Go to the script folder:

    cd auditlog-integration

  5. Install the necessary dependencies:

    pip3 install -r requirements.txt

  6. Create a .env configuration file:

    touch .env

  7. Open the .env configuration file:

    nano .env

  8. Fill in the .env configuration file:

    8.1. Add a block with authentication parameters for the Audit Logs service API:

    AUDIT_LOGS_URL=<base_url>/v1/logs
    USERNAME=<username>
    PASSWORD=<password>
    ACCOUNT_ID=<account_id>

    Specify:

    • <base_url> — the URL for accessing the audit log API in the required pool. You can find the list of URLs in the Audit logs subsection of the List of URLs guide;
    • <username> — the name of the service user you created in step 1;
    • <password> — service user password. If the password contains the characters [ ] \ ^ $. |? * + (), escape them — put a backslash before the character \;
    • <account_id> — the account number, available in the Control Panel in the upper-right corner.

    8.2. Add a block with event submission parameters:

    TRANSPORT_TYPE=file

    By default, logs are saved in the script folder to the events.txt file.

    8.3. Add a line with the API request interval:

    POLL_INTERVAL=<poll_interval>

    Specify <poll_interval> — the API polling interval in seconds (default is 30).

    8.4. Save and exit the file by consecutively pressing Ctrl+X → Y → Enter.

    8.5. Optional: change the name of the file where logs are saved; to do this, in the script folder, in the savers.py file in the class FileSaver block, change the value in the self.filename field.

  9. Run the script:

    python3 main.py

5. Configure log ingestion in the SIEM system

Configure log ingestion in your SIEM system. Use the official documentation for your SIEM system.