Contact UsGet started

Exporting audit logs to MaxPatrol SIEM

Written by
Updated at November 14, 2024

MaxPatrol SIEM can read Yandex Cloud audit logs from a Yandex Data Streams data stream. To complete the tutorial, you must have access to an instance of MaxPatrol SIEM.

To configure audit log export:

  1. Prepare your cloud.
  2. Prepare the environment.
  3. Create a trail to send logs to a Data Streams data stream.
  4. In MaxPatrol SIEM, set up a job to collect data from a Data Streams data stream.

If you no longer need the resources you created, delete them.

Getting started

Sign up for Yandex Cloud and create a billing account:

  1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

The infrastructure support cost includes:

Prepare the environment

Create a service account and assign roles

On behalf of a service account, the trail will gather logs from all the organization's resources and upload them to a Data Streams data stream.

Create a service account in the same folder where you create the trail, e.g., in example-folder:

  1. In the management console, select example-folder.
  2. In the list of services, select Identity and Access Management.
  3. Click Create service account.
  4. Enter a name for the service account: maxpatrol-sa.
  5. Click Create.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

  1. Create a service account:

    yc iam service-account create --name maxpatrol-sa

    Result:

    id: aje*****ckg
folder_id: b1g*****rnj
created_at: "2022-09-18..."
name: maxpatrol-sa

    For more information about the yc iam service-account create command, see the CLI reference.

Assign the audit-trails.viewer and yds.editor roles to the maxpatrol-sa service account:

  1. The audit-trails.viewer role for an organization:

    yc organization-manager organization add-access-binding \
--role audit-trails.viewer \
--id <organization_ID> \
--service-account-id <service_account_ID>

    Where:

    • --role: Role you want to assign.
    • --id: ID of the organization the service account belongs to.
    • --service-account-id: maxpatrol-sa service account ID.

    Result:

    done (1s)

    For more information about the yc organization-manager organization add-access-binding command, see the CLI reference.

  2. The yds.editor role for a folder:

    yc resource-manager folder add-access-binding example-folder \
  --role yds.editor \
  --subject serviceAccount:<service_account_ID>

    Where:

    • --role: Role you want to assign.
    • --subject: maxpatrol-sa service account ID.

    Result:

    done (1s)

    For more information about the yc resource-manager folder add-access-binding command, see the CLI reference.

Create static access keys

MaxPatrol SIEM uses static access keys to authorize Data Streams data stream queries.

  1. In the management console, select example-folder.
  2. In the list of services, select Identity and Access Management.
  3. In the left-hand panel, select Service accounts.
  4. Select the maxpatrol-sa service account from the list that opens.
  5. Click Create new key on the top panel.
  6. Select Create static access key.
  7. Enter a description for the key and click Create.

Alert

Save the ID and private key. After you close the dialog, the private key value will become unavailable.

Create a static access key for the maxpatrol-sa service account:

yc iam access-key create --service-account-name maxpatrol-sa

Result:

access_key:
id: YCd*****W7t
service_account_id: aje*****ckg
created_at: "2022-09-18..."
key_id: YCA*****5Ws4
secret: YCM76*******I3fk

Alert

Save the ID (key_id) and secret key (secret). You cannot retrieve the key value a second time.

For more information about the yc iam access-key create command, see the CLI reference.

Create a serverless database YDB

The database is required for the Data Streams data stream.

  1. In the management console, select example-folder.
  2. Click Create resource and select YDB database.
  3. Specify Name: maxpatrol-db.
  4. Under Database type, select Serverless.
  5. Leave the other parameters at their default settings.
  6. Click Create a database.

Wait for the database status to change to Running.

  1. Create a database:

    yc ydb database create --name maxpatrol-db --serverless --folder-name example-folder

    Where:

    • --name: Database name.
    • --serverless: Serverless type.
    • --folder-name: Folder name.

    Result:

    done (7s)
id: etn*****r5t
folder_id: b1g*****rnj
created_at: "2022-09-18..."
name: maxpatrol-db
status: PROVISIONING
...

    For more information about the yc ydb database create command, see the CLI reference.

  2. Check the status of the created database:

    yc ydb database get maxpatrol-db

    Wait for the database status to change to RUNNING.

Create a data stream

This is the data stream the trail will upload organization resource logs to.

  1. In the management console, select example-folder.
  2. Click Create resource and select Data Streams.
  3. In the Database field, select maxpatrol-db.
  4. Specify Name maxpatrol-stream.
  5. Leave the other parameters at their default settings.
  6. Click Create.

Wait for the data stream status to change to Running.

Create a trail

The trail will collect management audit logs for all your organization's resources and upload them to the maxpatrol-stream data stream.

  1. In the management console, select example-folder.
  2. Click Create resource and select the Audit trail option.
  3. Specify the Name of the maxpatrol-trail you are creating.
  4. Under Destination, configure the destination object:
    • Destination: Data Streams.
    • Data stream: Select the maxpatrol-stream data stream.
  5. Under Service account, select the maxpatrol-sa service account.
  6. Under Collecting management events, configure the collection of management event audit logs:
    • Collecting events: Select Enabled.
    • Resource: Select Organization.
    • Organization: Automatically populated field (shows the name of the organization with the trail).
    • Cloud: Keep the default value, All.
  7. Under Collecting data events, select Disabled in the Collecting events field.
  8. Click Create.

Configure MaxPatrol SIEM

Create accounts

You can use accounts to store secrets. Create accounts named static-key-id and static-key-private to store your ID and private access key:

  1. Log in to the MaxPatrol SIEM web interface.
  2. Under Data collection, click Accounts.
  3. Click Add account → Password and specify the following parameters:
    • Name: static-key-id.
    • Password: Static key ID.
    • Confirm password: Reenter static key ID.
  4. Click Save.

Similarly, create an account named static-key-private containing the private key.

Create a data collection job

Create and run a data collection job with the Yandex Data Streams profile:

  1. Log in to the MaxPatrol SIEM web interface.
  2. Under Data collection, click Tasks.
  3. On the Data collection tasks page:
    1. On the toolbar, click Create task.
    2. Click Data collection.
  4. On the Create data collection task page, specify the parameters below:
    1. Name: YDS-logs-task.
    2. Profile: Yandex Data Streams.
    3. In the hierarchy list, select Run script.
    4. Under Connection, specify:
      • Account: static-key-id.
      • Access upgrade account: static-key-private.
    5. Script runtime parameters:
      • database: <maxpatrol-db_ID>
      • folder: <cloud_ID_for_example-folder>
      • region_name: ru-central1.
      • stream_name: <maxpatrol-stream_name>.
    6. On the Data collection objectives panel:
      1. Select the Enable tab.
      2. In the Network addresses field, enter yandex-cloud.
    7. Click Save and run.

To view the logs, go to the event review page:

  1. Go the to the Data collection tasks page.
  2. Click YDS-logs-task.
  3. Click Events collected → Select.

How to delete the resources you created

Delete the resources you no longer need to avoid paying for them:

  • Delete the maxpatrol-stream stream.
  • Delete the maxpatrol-db database.
Previous
Configuring a response in Cloud Functions
Next
Exporting audit logs to SIEM Splunk systems