Customize integration with RuSIEM SIEM system

1. If you do not have RuSIEM installed, install it.
2. Optional: configure ports for receiving audit logs in RuSIEM.
3. Create a service user.
4. Obtain an IAM token for your account.
5. Obtain a script for exporting audit logs.
6. Configure and run the script.
7. Configure receiving audit logs in RuSIEM.

1. Install RuSIEM

1. Open the CLI.

2. Install RuSIEM:

   wget https://files.rusiem.tech/nextcloud/s/j6wcHzzaqT8w5wc/download -O install.sh; bash ./install.sh

3. In the interactive menu, specify the system parameters. For more details, see the RuSIEM documentation.

2. Optional: change the port for receiving audit logs in RuSIEM

1. Log in to the RuSIEM web interface.
2. Go to Settings → Microservice Configuration.
3. Select the Expert Mode checkbox.
4. Click .
5. Change the port number in the syslog configuration.
6. Click Save.

3. Create a service user

Add a service user with the audit_logs.admin role.

Users can be added by the Account Owner or by users with the iam.admin role.

4. Obtain an IAM token for your account

Get an IAM token for the account for the service user you created in step 3.

5. Obtain a script for exporting audit logs

We have prepared a script for exporting audit logs; it allows you to download logs to a file, as well as send them to a specified IP address or endpoint via the syslog or HTTP/HTTPS protocol.

1. Open the CLI.

2. Clone the script repository:

   git clone https://github.com/t-rex-general/auditlog-integration.git

   The script files will be saved in the working directory to the auditlog-integration folder.

6. Configure and run the script

1. Open the CLI.

2. Create a virtual environment:

   python3 -m venv .venv

3. Activate the virtual environment:

   source .venv/bin/activate

4. Go to the script folder:

   cd auditlog-integration

5. Install the necessary dependencies:

   pip3 install -r requirements.txt

6. Create a configuration file .env:

   touch .env

7. Open the configuration file .env:

   nano .env

8. Fill in the configuration file .env:

   8.1. Add a block with authentication parameters for the Audit Logs service API:

   AUDIT_LOGS_URL=<base_url>/v1/logs
   USERNAME=<username>
   PASSWORD=<password>
   ACCOUNT_ID=<account_id>

   Specify:

   • <base_url> — the URL for accessing the Audit Logs API in the required pool. You can view the list of URLs in the Audit Logs subsection of the List of URLs guide;
   • <username> — the name of the service user you created in step 3;
   • <password> — the service user password. If the password contains [ ] \ ^ $. |? * + () characters, escape them by placing a backslash \; before each character.
   • <account_id> — the account number, which can be viewed in the Control Panel in the top-right corner.

   8.2. Add a block with event submission parameters:

   TRANSPORT_TYPE=syslog
   SYSLOG_ENABLED=true
   SYSLOG_HOST=<syslog_host>
   SYSLOG_PORT=<syslog_port>

   Specify:

   • <syslog_host> — the SIEM system IP address;
   • <syslog_port> — the SIEM system port.

   8.3. Add a line with the API request interval:

   POLL_INTERVAL=<poll_interval>

   Specify <poll_interval> — the API polling interval in seconds (default is 30).

   8.4. Exit the file while saving; to do this, press Ctrl+X → Y → Enter.

9. Run the script:

   python3 main.py

7. Configure receiving audit logs in RuSIEM

1. In the RuSIEM web interface, go to the Events → All events.
2. On the top panel, click Settings.
3. Check the Search by unparsed events.
4. Click Save.
5. In the Filter Settings field, enter your Servercore account number and click . The account number can be viewed in the Control Panel in the top-right corner. The RuSIEM web interface will display events from the Audit Logs service.