Customize integration with RuSIEM SIEM system

If you do not have the RuSIEM system installed, install it.
Optional: configure ports for audit log ingestion in RuSIEM.
Create a service user.
Get an account-scoped IAM token.
Get the script to export audit logs.
Configure and run the script.
Configure audit log ingestion in RuSIEM.

1. Install RuSIEM

Open the CLI.

Install RuSIEM:

wget https://files.rusiem.tech/nextcloud/s/j6wcHzzaqT8w5wc/download -O install.sh; bash ./install.sh

In the interactive menu, specify the system parameters. Learn more in the documentation of RuSIEM.

2. Optional: change the port for receiving audit logs in RuSIEM

Log in to the RuSIEM web interface.
Go to Settings → Microservice Settings.
Select the Expert Mode checkbox.
Click .
Change the port number in the syslog configuration.
Click Save.

3. Create a service user

Add a service user with the role audit_logs.admin.

Users can be added by the Account Owner or users with the role iam.admin.

4. Obtain an IAM token for your account

Get an account-scoped IAM token for the service user you created in step 3.

5. Obtain a script for exporting audit logs

We have prepared a script for exporting audit logs — it allows you to export logs to a file, as well as send them to a specified IP address or endpoint via syslog or HTTP/HTTPS.

Open the CLI.
Clone the script repository:
```
git clone https://github.com/t-rex-general/auditlog-integration.git
```
The script files will be saved to the working directory in the auditlog-integration folder.

6. Configure and run the script

Open the CLI.
Create a virtual environment:
```
python3 -m venv .venv
```
Activate the virtual environment:
```
source .venv/bin/activate
```
Go to the script folder:
```
cd auditlog-integration
```
Install the necessary dependencies:
```
pip3 install -r requirements.txt
```
Create the .env configuration file:
```
touch .env
```
Open the .env configuration file:
```
nano .env
```
Fill in the .env configuration file:

8.1. Add a block with authentication parameters for the Audit Logs service API:
```
AUDIT_LOGS_URL=<base_url>/v1/logs
USERNAME=<username>
PASSWORD=<password>
ACCOUNT_ID=<account_id>
```
Specify:
- <base_url> — URL to access the Audit Logs API in the required pool. You can find the list of URLs in the subsection Audit logs of the instructions List of URLs;
- <username> — username of the service user you created in step 3;
- <password> — password of the service user. If the password contains the characters [ ] \ ^ $. |? * + (), escape them by adding a backslash before the character: \;
- <account_id> — account number, which can be found in the Control Panel in the top right corner.
8.2. Add a block with event submission parameters:
```
TRANSPORT_TYPE=syslog
SYSLOG_ENABLED=true
SYSLOG_HOST=<syslog_host>
SYSLOG_PORT=<syslog_port>
```
Specify:
- <syslog_host> — IP address of the SIEM system;
- <syslog_port> — port of the SIEM system.
8.3. Add a line with the API request interval:
```
POLL_INTERVAL=<poll_interval>
```
Specify <poll_interval> — API polling interval in seconds (default is 30).

8.4. Save and exit the file by pressing Ctrl+X → Y → Enter.
Run the script:
```
python3 main.py
```

7. Configure receiving audit logs in RuSIEM

In the RuSIEM web interface, go to Events → All Events.
On the top bar, click Parameters.
Select the Search Unparsed Events checkbox.
Click Save.
In the Filter Settings field, enter your Selectel account number and click . You can find the account number in the Control Panel in the top right corner. The RuSIEM web interface will display events from the Audit Logs service.