Contact UsGet started

Exporting audit logs to MaxPatrol SIEM

Written by
Updated at July 8, 2024

MaxPatrol SIEM can read Yandex Cloud audit logs from a Yandex Data Streams data stream. To complete the tutorial, you must have access to an instance of MaxPatrol SIEM.

To configure audit log export:

  1. Prepare your cloud.
  2. Prepare the environment.
  3. Create a trail to send logs to a Data Streams data stream.
  4. In MaxPatrol SIEM, set up a job to collect data from a Data Streams data stream.

If you no longer need the resources you created, delete them.

Getting started

Sign up for Yandex Cloud and create a billing account:

  1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

The infrastructure support cost includes:

Prepare the environment

Create a service account and assign roles

On behalf of a service account, the trail will gather logs from all the organization's resources and upload them to a Data Streams data stream.

Create a service account in the same folder as the trail, e.g., example-folder:

  1. In the management console, select example-folder.
  2. At the top of the screen, go to the Service accounts tab.
  3. Click Create service account.
  4. Enter maxpatrol-sa as your service account name.
  5. Click Create.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

  1. Create a service account:

    yc iam service-account create --name maxpatrol-sa

    Result:

    id: aje*****ckg
folder_id: b1g*****rnj
created_at: "2022-09-18..."
name: maxpatrol-sa

    For more information about the yc iam service-account create command, see the CLI reference.

Assign your maxpatrol-sa service account the audit-trails.viewer and the yds.editor roles:

  1. The audit-trails.viewer role to the organization:

    yc organization-manager organization add-access-binding \
--role audit-trails.viewer \
--id <organization_ID> \
--service-account-id <service_account_ID>

    Where:

    • --role: Role being assigned.
    • --id: ID of the organization the service account belongs to.
    • --service-account-id: ID of the maxpatrol-sa service account.

    Result:

    done (1s)

    For more information about the yc resource-manager organization add-access-binding command, see the CLI reference.

  2. The yds.editor role to example-folder:

    yc resource-manager folder add-access-binding example-folder \
  --role yds.editor \
  --subject serviceAccount:<service_account_ID>

    Where:

    • --role: Role being assigned.
    • --subject: ID of the maxpatrol-sa service account.

    Result:

    done (1s)

    For more information about the yc resource-manager folder add-access-binding command, see the CLI reference.

Create static access keys

MaxPatrol SIEM uses static access keys to authorize Data Streams data stream queries.

  1. In the management console, select example-folder.
  2. At the top of the screen, go to the Service accounts tab.
  3. Select the maxpatrol-sa service account and click the row with its name.
  4. Click Create new key on the top panel.
  5. Select Create static access key.
  6. Enter a description for the key and click Create.

Alert

Save the ID and private key. After you close the dialog, the private key value will become unavailable.

Create a static access key for the maxpatrol-sa service account:

yc iam access-key create --service-account-name maxpatrol-sa

Result:

access_key:
id: YCd*****W7t
service_account_id: aje*****ckg
created_at: "2022-09-18..."
key_id: YCA*****5Ws4
secret: YCM76*******I3fk

Alert

Save the ID key_id and secret key secret. You cannot retrieve the key value a second time.

For more information about the yc iam access-key create command, see the CLI reference.

Create a serverless database YDB

The database is required for the Data Streams data stream.

  1. In the management console, select example-folder.
  2. Click Create resource and select YDB database.
  3. Enter maxpatrol-db as the Name.
  4. Under Database type, select Serverless.
  5. Leave the other parameters at their default settings.
  6. Click Create a database.

Wait for the database status to change to Running.

  1. Create a database:

    yc ydb database create --name maxpatrol-db --serverless --folder-name example-folder

    Where:

    • --name: Database name.
    • --serverless: Serverless type.
    • --folder-name: Folder name.

    Result:

    done (7s)
id: etn*****r5t
folder_id: b1g*****rnj
created_at: "2022-09-18..."
name: maxpatrol-db
status: PROVISIONING
...

    For more information about the yc iam database create command, see the CLI reference.

  2. Check the status of the created database:

    yc ydb database get maxpatrol-db

    Wait for the database status to change to Running.

Create a data stream

This is the data stream the trail will upload organization resource logs to.

  1. In the management console, select example-folder.
  2. Click Create resource and select Data Streams.
  3. In the Database field, select maxpatrol-db.
  4. Enter maxpatrol-stream as the Name.
  5. Leave the other parameters at their default settings.
  6. Click Create.

Wait for the data stream status to change to Running.

Create a trail

The trail will collect management event audit logs for all your organization's resources and upload them to the maxpatrol-stream data stream.

  1. In the management console, select example-folder.
  2. Click Create resource and select the Audit trail option.
  3. Enter the new trail's Name: maxpatrol-trail.
  4. Under Destination, configure the destination object:
    • Destination: Data Streams.
    • Data stream: Select the maxpatrol-stream data stream.
  5. Under Service account, select the maxpatrol-sa service account.
  6. Under Collecting management events, configure the collection of management event audit logs:
    • Collecting events: Select Enabled.
    • Resource: Select Organization.
    • Organization: Automatically populated field (shows the name of the organization with the trail).
    • Cloud: Keep the default value, All.
  7. Under Collecting data events, select Disabled in the Collecting events field.
  8. Click Create.

Configure MaxPatrol SIEM

Create accounts

You can use accounts to store secrets. Create accounts named static-key-id and static-key-private for the ID and the private access key:

  1. Log in to the MaxPatrol SIEM web interface.
  2. Under Data collection, click Accounts.
  3. Click Add account → Password and specify the following parameters:
    • Name: static-key-id.
    • Password: Static key ID.
    • Confirm password: Reenter static key ID.
  4. Click Save.

Similarly, create an account named static-key-private containing the private key.

Create a data collection job

Create and run a data collection job with the Yandex Data Streams profile:

  1. Log in to the MaxPatrol SIEM web interface.
  2. Under Data collection, click Tasks.
  3. On the Data collection tasks page:
    1. On the toolbar, click Create task.
    2. Click Data collection.
  4. On the Create data collection task page, specify the parameters below:
    1. Name: YDS-logs-task.
    2. Profile: Yandex Data Streams.
    3. In the hierarchy list, select Run script.
    4. Under Connection, specify:
      • Account: static-key-id
      • Access upgrade account: static-key-private
    5. Script runtime parameters:
      • database: <maxpatrol-db_database_ID>
      • folder: <cloud_ID_for_example-folder>
      • region_name: ru-central1
      • stream_name: <maxpatrol-stream_name>
    6. On the Data collection objectives panel:
      1. Select the Enable tab.
      2. In the Network addresses field, enter yandex-cloud.
    7. Click Save and run.

To view the logs, go to the event review page:

  1. Go the to the Data collection tasks page.
  2. Click the YDS-logs-task task.
  3. Click Events collected → Select.

How to delete the resources you created

Delete the resources you no longer need to avoid paying for them:

  • Delete the maxpatrol-stream data stream.
  • Delete the maxpatrol-db database.
Previous
Uploading audit logs to Yandex Managed Service for OpenSearch
Next
Exporting audit logs to SIEM Splunk systems