Stream the audit log to Sumo Logic

Administrator·3 minutes to read

What this does for you

Every new entry in your organisation's audit log reaches Sumo Logic within a minute of being written, through an HTTP Logs and Metrics source. Each entry is one message: one line of JSON, the entry as the audit export writes it with your organisation's id beside it. Messages arrive with the source name botseon-audit and, if you set one, your source category. Only an owner or an administrator can see or change audit streams.

Before you start

Your team is on Enterprise or its two-week Enterprise trial. The audit log and its streams are part of the Enterprise plan: on a Team plan, Organisation → Audit shows The audit log, its exports and the SIEM stream are part of the Enterprise plan. with a link to See Enterprise.
A hosted collector with an HTTP Logs & Metrics source, and the source's presigned URL. The URL is the credential, so treat it like a password.
On the source, leave One Message Per Request off: Botseon sends many entries in one request, one per line. Multiline processing can be off too, since every entry is one line.

Steps

Open Organisation → Audit and find Audit streams.
Under Destination, choose Sumo Logic HTTP source.
Give it a Name.
Paste the HTTP source URL. It is stored encrypted and never shown again; the row shows only its host.
Optionally enter a Source category (optional), which overrides the source's own.
Press Add stream.

Use the stream's switch to turn it off or back on; Remove stops it and deletes the URL.

A worked example

An administrator adds a stream named Security SIEM with category security/botseon. When a member is removed, searching _sourceCategory=security/botseon finds the entry within a minute as one JSON message, and | json "action" reads its action.

What can go wrong

The stream's row on Organisation → Audit shows the last delivery and, when the newest attempt failed, why and when it is tried again. A failed batch is never skipped: the same entries are sent again after 15 seconds, then 30 seconds, 1 minute, 5 minutes, 15 minutes, and then every hour until the destination takes them.

What the row says	What to do
the destination refused the request (HTTP 401 or 404)	the source URL was regenerated, which invalidates the old one: remove the stream and add it with the new URL
the destination refused the request (HTTP 429)	your account is over its ingest limit; it is retried
the destination could not be reached / did not answer in time	Sumo Logic is unreachable; it is retried
many entries arrive as one message	One Message Per Request is on for the source