Set up an audit log webhook

1. From the navigation menu, open Organization, then Audit Logs Setup.
2. Fill in the fields in the Setup tab.
   • Region endpoint: The external endpoint that will receive audit log messages.

   • Authorization Header: The authorization type and credential to pass to your log collection endpoint. Konnect will send this string in the Authorization header of requests to that endpoint.

     For example, if you are setting up the webhook for Splunk, you could provide a Splunk access token: "authorization":"Splunk example-token12234352535235".

   • Log Format: The output format of each log message. Can be CEF or JSON.
   • Skip SSL Verification: Skip SSL verification of the host endpoint when delivering payloads.

   We strongly recommend not setting this to true as you are subject to man-in-the-middle and other attacks. This option should be considered only when using self-signed SSL certificates in a non-production environment.

3. Switch the toggle to Enabled, then save your webhook configuration.

Now that you have an external endpoint and authorization credentials, you can set up a webhook in Konnect.

Create a webhook by sending a request to the /audit-log-webhook endpoint with the connection details for your SIEM vendor:

curl -i -X PATCH https://global.api.konghq.com/v2/audit-log-webhook \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer TOKEN" \
    --data '{"endpoint":"https://example.com/audit-logs","enabled":true,"authorization":"Bearer example-token","log_format":"cef"}'

Replace the following placeholders with your own data:

• global.api.konghq.com: The region your org is in. Can be global to target all regions, us, or eu.
• TOKEN: A Konnect personal access token or system account token.

• "endpoint":"https://example.com/audit-logs": The external endpoint that will receive audit log messages.

  Check your SIEM documentation to find out where to send CEF data.

• "authorization":"Bearer example-token": The authorization type and credential to pass to your log collection endpoint. Konnect will send this string in the Authorization header of requests to that endpoint.

  For example, if you are setting up the webhook for Splunk, you could provide a Splunk access token: "authorization":"Splunk example-token12234352535235".

• log_format: The output format of each log message. Can be cef or json.

• skip_ssl_verification: (Optional) Set to true to skip SSL verification of the host endpoint when delivering payloads.

  We strongly recommend not setting this to true as you are subject to man-in-the-middle and other attacks. This option should be considered only when using self-signed SSL certificates in a non-production environment.

If the request is successful, you will receive a 200 response code, and a response body containing the webhook’s configuration details:

{
    "endpoint":"https://example.com/audit-logs",
    "log_format":"cef",
    "enabled":true,
    "skip_ssl_verification":false,
    "updated_at":"2023-04-01T00:00:01Z"
}

You can view the status of your webhook through the Audit Logs Setup page under Organization.

Notice the status badge next to title of the webhook. For example, the following webhook is active:

To find the last attempt timestamp and the last response code, use the audit log API.

View your audit log webhook configuration by running the following command:

curl https://global.api.konghq.com/v2/audit-log-webhook \
    --header "Authorization: Bearer TOKEN"

You will receive a 200 response code and the following data. Note that the authorization property is not included in any responses:

{
    "endpoint":"https://example.com/audit-logs",
    "log_format":"cef",
    "enabled":true,
    "skip_ssl_verification":false,
    "updated_at":"2023-04-01T00:00:01Z"
}

View your audit log webhook status by running the following command:

curl https://global.api.konghq.com/v2/audit-log-webhook/status \
    --header "Authorization: Bearer TOKEN"

You will receive a 200 response code and a response body with information about the webhook status:

{
    "last_attempt_at": "2023-04-04T18:11:16Z",
    "last_response_code": 200,
    "webhook_enabled": true,
    "webhook_status": "active"
}