Searching for Yandex Cloud events in Object Storage

Getting startedGetting started

1. Install and set up s3fs or goofys to mount Object Storage buckets using FUSE.
2. Mount a bucket with audit logs to your file system using s3fs or goofys.
3. Install jq to search through data in JSON format.

Search scenariosSearch scenarios

1. To search through multiple files, use the find command. As a command-line argument, enter the path to the mount directory of the audit log bucket or to its subdirectory with logs for a certain month or day.

   Example of a command to search events by type:

   find <folder_path> -type f -exec cat {} \; | jq  '.[] | select( .event_type == "yandex.cloud.audit.iam.CreateServiceAccount")'
   

2. To find out who deleted a folder from the cloud, search by the eventType field across all files for the period, filtered by folder ID:

   find <folder_path> -type f -exec cat {} \; | jq  '.[] | select( .event_type == "yandex.cloud.audit.resourcemanager.DeleteFolder" and .details.folder_id == "<folder_ID>") | .authentication'
   

3. To find out who created, stopped, restarted, or deleted a VM, search by the eventType field across all files for the period, filtered by VM ID:

   find <folder_path> -type f -exec cat {} \; | jq  '.[] | select((.event_type | test("yandex\\.cloud\\.audit\\.compute\\..*Instance")) and .details.instance_id == "<VM_ID>") | .authentication'
   

4. To find out what actions a user performed over a period of time, search by the user ID:

   find <folder_path> -type f -exec cat {} \; | jq  '.[] | select(.authentication.subject_id == "<user_ID>" and .event_time > "2021-03-01" and .event_time < "2021-04-01")'
   

   You can also search by the user name:

   find <folder_path> -type f -exec cat {} \; | jq  '.[] | select(.authentication.subject_name == "<username>" and .event_time > "2021-03-01" and .event_time < "2021-04-01")'
   

5. To find out which events occurred to objects in a certain folder, search by the folder ID:

   find <folder_path> -type f -exec cat {} \; | jq  '.[] | select(.resource_metadata != null and .resource_metadata.path != null) | select( .resource_metadata.path[] | .resource_type == "resource-manager.folder" and .resource_id == "<folder_ID>")'
   

   You can also search by the folder name:

   find <folder_path> -type f -exec cat {} \; | jq  '.[] | select(.resource_metadata != null and .resource_metadata.path != null) | select( .resource_metadata.path[] | .resource_type == "resource-manager.folder" and .resource_name == "<folder_name>")'
   

Useful linksUseful links

• Audit log
• jq tutorial
• s3fs
• goofys