Exporting audit logs to SIEM Splunk systems

1. In the management console, select the folder where you want to create a bucket.
2. Select Object Storage.
3. Click Create bucket.
4. On the bucket creation page:

   1. Enter a name for the bucket consistent with the naming requirements.

      By default, a bucket with a dot in the name is only available over HTTP. To provide HTTPS support for your bucket, upload your own security certificate to Object Storage.

   2. Limit the maximum bucket size, if required.

      If the value is 0, the size is not limited. It is similar to the enabled No limit option.

   3. In the Object read access, Object listing access, and Read access to settings fields, select Restricted.

   4. Select the default storage class.

   5. Click Create bucket to complete the operation.

1. In the management console, select the folder containing your bucket.

2. Select Key Management Service.

3. Click Create key and set the key attributes:

   • Any name and optional description.
   • Encryption algorithm, e.g., AES-256.
   • Rotation period (how often to change key versions).
   • Click Create.

The key is created together with its first version: click the key in the list to open a page with its attributes.

1. In the management console, select the bucket you want to configure encryption for.

2. In the left-hand panel, select Security.

3. Open the Encryption tab.

4. In the KMS Key field, select an existing key or create a new one:

   1. If the folder does not contain any keys yet, click Create key. If the folder contains keys but they are not suitable, click Create.
   2. Enter a name for the key.
   3. Select an encryption algorithm and a rotation period.
   4. Click Create.

5. Click Save.

1. In the management console, select the folder where you want to create a service account.

2. From the list of services, select Identity and Access Management.

3. Click Create service account.

4. Enter a name for the service account. Follow these naming requirements:

   • It must be from 2 to 63 characters long.
   • It may contain lowercase Latin letters, numbers, and hyphens.
   • It must start with a letter and cannot end with a hyphen.

5. Click Create.

1. Assign the audit-trails.viewer role to the folder whose resources will be polled for audit logs:

   yc resource-manager folder add-access-binding \
   --role audit-trails.viewer \
   --id <folder_ID> \
   --service-account-id <service_account_ID>
   

   Where:

   • --role: Role to assign.
   • --id: ID of the folder from which audit logs will be collected.
   • --service-account-id: Service account ID.

2. Assign the storage.uploader role to the folder to host the trail:

   yc resource-manager folder add-access-binding \
   --role storage.uploader \
   --id <folder_ID> \
   --service-account-id <service_account_ID>
   

   Where:

   • --role: Role you want to assign.
   • --id: ID of the folder to host the trail.
   • --service-account-id: Service account ID.

3. Assign the kms.keys.encrypterDecrypter role to the encryption key:

   yc kms symmetric-key add-access-binding \
   --role kms.keys.encrypterDecrypter \
   --id <KMS_key_ID> \
   --service-account-id <service_account_ID>
   

   Where:

   • --role: Role to assign.
   • --id: KMS key ID.
   • --service-account-id: Service account ID.

1. In the management console, select the folder where you want to create the trail.

2. Select Audit Trails.

3. Click Create trail and specify:

   • Name: Name of the new trail.
   • Description: Trail description (optional).

4. Under Destination, configure the destination object:

   • Destination: Object Storage.
   • Bucket: Name of the bucket to which you want to upload audit logs.
   • Object prefix: Optional parameter used in the full name of the audit log file.

   Note

   Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.

   • Encryption key: Specify the encryption key the bucket is encrypted with.

5. Under Service account, select the service account that the trail will use to upload audit log files to the bucket.

6. Under Collecting management events, configure the collection of management event audit logs:

   • Collecting events: Select Enabled.
   • Resource: Select Folder.
   • Folder: Automatically populated field containing the name of the current folder.

7. Under Collecting data events, select Disabled in the Collecting events field.

8. Click Create.

1. Create a NAT gateway:

   1. In the management console, select the folder containing the subnet for the intermediate VM.

   2. From the list of services, select Virtual Private Cloud.

   3. In the left-hand panel, select Gateways.

   4. Click Create.

   5. Enter a name for the gateway. Follow these naming requirements:

      • It must be from 2 to 63 characters long.
      • It may contain lowercase Latin letters, numbers, and hyphens.
      • It must start with a letter and cannot end with a hyphen.

   6. The default gateway type is Egress NAT.

   7. Click Save.

2. Create a route table:
   1. In the left-hand panel, select Routing tables.
   2. Click Create to add a new table, or select an existing one.
   3. Click Add.
   4. In the window that opens, select Gateway in the Next hop field.
   5. In the Gateway field, select the NAT gateway you created. The destination prefix will apply automatically.
   6. Click Add.
   7. Click Save.
3. Link the route table to the subnet where you want to deploy the intermediate VM, to forward its traffic via the NAT gateway:
   1. In the left-hand panel, select Subnets.
   2. In the row with the subnet, click .
   3. In the menu that opens, select Link routing table.
   4. In the window that opens, select the created table from the list.
   5. Click Link.

1. If you do not have Terraform yet, install it and configure its Yandex Cloud provider.

2. Clone a repository from Yandex Cloud Security Solution Library:

   git clone https://github.com/yandex-cloud-examples/yc-export-auditlogs-to-splunk.git
   

3. Create a subfolder in /yc-export-auditlogs-to-splunk/terraform/ and go there.

4. Create a configuration file to invoke the yc-splunk-trail module:

   module "yc-splunk-trail" {
      source = "../modules/yc-splunk-trail/"
      folder_id = <folder_ID>
      splunk_token = <Event_Collector_token>
      splunk_server = <your_Splunk_server_address>:8088 
      bucket_name = <bucket_name>
      bucket_folder = <name_of_root_folder_in_bucket>
      sa_id = <service_account_ID>
      coi_subnet_id = <subnet_ID>
   }
   

   Where:

   • folder_id: Folder ID.
   • splunk_token: Event Collector token retrieved from Splunk.
   • splunk_server: Address of your Splunk server as https://<host_name_or_address>.
   • bucket_name: Bucket name.
   • bucket_folder: Name of the root folder in the bucket.
   • sa_id: Service account ID.
   • coi_subnet_id: ID of the subnet where you set up the NAT gateway.

5. Make sure that the configuration files are correct:

   terraform plan
   

   If you described the configuration correctly, the terminal will display a list of the resources being created and their settings. If the configuration contains any errors, Terraform will point them out.

6. Deploy the cloud resources.

   1. If the configuration does not contain any errors, run this command:

      terraform apply
      

   2. Confirm resource creation: enter yes in the terminal and press Enter.