---
title: "Customize integration with RuSIEM SIEM system"
sidebar_label: "Customize integration with RuSIEM"
sidebar_position: 3
description: "How to customize integration with RuSIEM SIEM system"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import EditIcon from '@selectel/docux/icons/edit'
import SearchIcon from '@selectel/docux/icons/search'
import GetScript from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/audit-logs/get-script.mdx'

# Customize integration with RuSIEM SIEM system

1. If you do not have RuSIEM installed, [install it](#set-up-rusiem).
2. Optional: [configure ports for receiving audit logs in RuSIEM](#configure-port).
3. [Create a service user](#create-service-user).
4. [Obtain an IAM token for your account](#create-iam-token-account-scoped).
5. [Obtain a script for exporting audit logs](#get-script).
6. [Configure and run the script](#configure-and-start-script).
7. [Configure receiving audit logs in RuSIEM](#configure-log-ingestion-in-rusiem).

## 1. Install RuSIEM \{#set-up-rusiem}

1. Open the CLI.

2. Install RuSIEM:

   ```bash
   wget https://files.rusiem.tech/nextcloud/s/j6wcHzzaqT8w5wc/download -O install.sh; bash ./install.sh
   ```

3. In the interactive menu, specify the system parameters. For more details, see the [RuSIEM](https://docs.rusiem.tech/) documentation.

## 2. Optional: change the port for receiving audit logs in RuSIEM \{#configure-port}

1. Log in to the RuSIEM web interface.
2. Go to **Settings** → **Microservice Configuration**.
3. Select the **Expert Mode** checkbox.
4. Click <EditIcon />.
5. Change the port number in the syslog configuration.
6. Click **Save**.

## 3. Create a service user \{#create-service-user}

[Add a service user](/access-control/manage/add-user.mdx#add-service-user) with the [`audit_logs.admin`](/access-control/role-reference.mdx#audit-logs-admin)[ role](/access-control/role-reference.mdx#audit-logs-admin).

Users can be added by the [Account Owner](/access-control/user-types.mdx#account-owner) or by users with the [`iam.admin`](/access-control/role-reference.mdx#iam-admin)[ role](/access-control/role-reference.mdx#iam-admin).

## 4. Obtain an IAM token for your account \{#create-iam-token-account-scoped}

[Get an IAM token for the account](/api/authorization/#get-iam-token-account-scoped) for the service user you [created in step 3](#create-service-user).

## 5. Obtain a script for exporting audit logs \{#get-script}

<GetScript />

## 6. Configure and run the script \{#configure-and-start-script}

1. Open the CLI.

2. Create a virtual environment:

   ```bash
   python3 -m venv .venv
   ```

3. Activate the virtual environment:

   ```bash
   source .venv/bin/activate
   ```

4. Go to the script folder:

   ```bash
   cd auditlog-integration
   ```

5. Install the necessary dependencies:

   ```bash
   pip3 install -r requirements.txt
   ```

6. Create a configuration file `.env`:

   ```bash
   touch .env
   ```

7. Open the configuration file `.env`:

   ```bash
   nano .env
   ```

8. Fill in the configuration file `.env`:

   8.1. Add a block with authentication parameters for the Audit Logs service API:

   ```bash
   AUDIT_LOGS_URL=<base_url>/v1/logs
   USERNAME=<username>
   PASSWORD=<password>
   ACCOUNT_ID=<account_id>
   ```

   Specify:

   * `<base_url>` — the URL for accessing the Audit Logs API in the required pool. You can view the list of URLs in the [Audit Logs](/api/urls/#audit-logs) subsection of the [List of URLs](/api/urls/)[ guide](/api/urls/);
   * `<username>` — the name of the service user you [created in step 3](#create-service-user);
   * `<password>` — the service user password. If the password contains `[` `]` `\` `^` `$.` `|?` `*` `+` `()` characters, escape them by placing a backslash `\;` before each character.
   * `<account_id>` — the account number, which can be viewed in the [Control Panel](https://my.selectel.ru/) in the top-right corner.

   8.2. Add a block with event submission parameters:

   ```bash
   TRANSPORT_TYPE=syslog
   SYSLOG_ENABLED=true
   SYSLOG_HOST=<syslog_host>
   SYSLOG_PORT=<syslog_port>
   ```

   Specify:

   * `<syslog_host>` — the SIEM system IP address;
   * `<syslog_port>` — the SIEM system port.

   8.3. Add a line with the API request interval:

   ```bash
   POLL_INTERVAL=<poll_interval>
   ```

   Specify `<poll_interval>` — the API polling interval in seconds (default is 30).

   8.4. Exit the file while saving; to do this, press **Ctrl+X** → **Y** → **Enter**.

9. Run the script:

   ```bash
   python3 main.py
   ```

## 7. Configure receiving audit logs in RuSIEM \{#configure-log-ingestion-in-rusiem}

1. In the RuSIEM web interface, go to the **Events** → **All events**.
2. On the top panel, click **Settings**.
3. Check the **Search by unparsed events**.
4. Click **Save**.
5. In the **Filter Settings** field, enter your Selectel account number and click <SearchIcon />. The account number can be viewed in the [Control Panel](https://my.selectel.ru) in the top-right corner. The RuSIEM web interface will display events from the Audit Logs service.

<Formbricks />