Collect Konnect audit logs

This is a Konnect tutorial and requires a Konnect personal access token.

1. Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

2. Export your token to an environment variable:

    export KONNECT_TOKEN='YOUR_KONNECT_PAT'
   

   Copied!

3. Run the quickstart script to automatically provision a Control Plane and Data Plane, and configure your environment:

    curl -Ls https://get.konghq.com/quickstart | bash -s -- -k $KONNECT_TOKEN --deck-output
   

   Copied!

   This sets up a Konnect Control Plane named quickstart, provisions a local Data Plane, and prints out the following environment variable exports:

    export DECK_KONNECT_TOKEN=$KONNECT_TOKEN
    export DECK_KONNECT_CONTROL_PLANE_NAME=quickstart
    export KONNECT_CONTROL_PLANE_URL=https://us.api.konghq.com
    export KONNECT_PROXY_URL='http://localhost:8000'
   

   Copied!

   Copy and paste these into your terminal to configure your session.

To use the audit log webhook, you need a configured SIEM provider. In this tutorial, we’ll use SumoLogic, but you can use any SIEM provider that supports the ArcSight CEF Format or raw JSON. Konnect supports any HTTP authorization header type.

Before you can push audit logs to your SIEM provider, configure the service to receive logs. This configuration is specific to your vendor.

In this tutorial, we’ll configure an HTTPS data collector and source in SumoLogic.

1. In the SumoLogic sidebar, click Data Management > Collection.
2. Click Add Collector.
3. Click Hosted Collector.
4. In the Name field, enter Konnect.
5. When prompted to add a new data source to the collector, click OK.
6. Select HTTP Logs & Metrics.
7. In the Name field, enter Konnect.
8. Click OK.
9. Copy and export the SumoLogic endpoint URL in terminal:

   export SIEM_ENDPOINT='YOUR-SIEM-HTTP-ENDPOINT'
   

   Copied!
10. In the SumoLogic sidebar, click Administration > Account Security Settings > Access Keys to create an access key.
11. Click Add Access Key.
12. In the Name field, enter Konnect.
13. Click Save.
14. Export the access key as an environment variable in your terminal:

    export SIEM_TOKEN='YOUR-ACCESS-KEY'
    

    Copied!
15. Click Done.

If needed, configure your network’s firewall settings to allow traffic through the 8071 TCP or UDP port that Konnect uses for audit logging. See the Konnect ports and network requirements.