Stream the audit log to Splunk

What this does for you

Every new entry in your organisation's audit log reaches your Splunk index within a minute of being written, through the HTTP Event Collector (HEC). Each entry is one HEC event: the entry as the audit export writes it (id, time, who, action, target, details, the surface and the chain hashes), with your organisation's id beside it, under the sourcetype botseon:audit unless you choose another. Only an owner or an administrator can see or change audit streams.

Before you start

• Your team is on Enterprise or its two-week Enterprise trial. The audit log and its streams are part of the Enterprise plan: on a Team plan, Organisation → Audit shows The audit log, its exports and the SIEM stream are part of the Enterprise plan. with a link to See Enterprise.
• A HEC token. In Splunk: Settings → Data inputs → HTTP Event Collector → New Token. Leave Enable indexer acknowledgement off: Botseon does not send a channel id, and a token with acknowledgement on refuses every request without one.
• The index the events should land in, allowed for that token.
• The collector's https address, reachable from the internet. On Splunk Cloud Platform it is https://http-inputs-<your stack>.splunkcloud.com. A private or local address is refused.

Steps

1. Open Organisation → Audit and find Audit streams.
2. Under Destination, choose Splunk HTTP Event Collector.
3. Give it a Name, such as Security SIEM.
4. Enter the Address. Events go to /services/collector/event under it, unless the address already names a collector path.
5. Paste the HEC token. Optionally enter an Index (optional) and a Sourcetype (optional).
6. Press Add stream. The token is stored encrypted and never shown again.

Use the stream's switch to turn it off (nothing more is sent) or back on (everything written since is sent next). Remove stops it and deletes its token.

A worked example

An administrator adds a stream named Security SIEM with the address https://http-inputs-acme.splunkcloud.com, the index botseon and the default sourcetype. A colleague then changes the organisation's invite policy. Within a minute, searching index=botseon sourcetype="botseon:audit" action="org.invite_policy_changed" finds the entry, and the stream's row reads "Last delivery … (HTTP 200)".

What can go wrong

The stream's row on Organisation → Audit shows the last delivery and, when the newest attempt failed, why and when it is tried again. A failed batch is never skipped: the same entries are sent again after 15 seconds, then 30 seconds, 1 minute, 5 minutes, 15 minutes, and then every hour until the destination takes them.

See also

• Organisation policies — the audit log the stream reads from
• Stream to Sumo Logic, an HTTPS webhook or Amazon S3
• To revoke at Splunk, disable or delete the HEC token; Botseon's copy is deleted when you remove the stream.