Recover Dev Portal audit logs

This tutorial requires a Konnect Plus account. If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

To recover audit logs, you need the Admin role for audit logs.

For this tutorial, you’ll need a Dev Portal pre-configured. If you don’t have these settings already configured, follow these steps to pre-configure it:

1. In the Konnect sidebar, click Dev Portal.
2. Click New portal to create a Dev Portal.
3. Click your Dev Portal URL at the top of the Dev Portal overview.
4. Click Sign up to register a test developer account with your Dev Portal.
5. If your settings require developer or application approval, you can manage approvals by navigating to Access and approvals in the Konnect sidebar.

To use the audit log webhook, you need a configured SIEM provider. In this tutorial, we’ll use SumoLogic, but you can use any SIEM provider that supports the ArcSight CEF Format or raw JSON. Konnect supports any HTTP authorization header type.

Before you can push audit logs to your SIEM provider, configure the service to receive logs. This configuration is specific to your vendor.

In this tutorial, we’ll configure an HTTPS data collector and source in SumoLogic.

1. In the SumoLogic sidebar, click Data Management > Collection.
2. Click Add Collector.
3. Click Hosted Collector.
4. In the Name field, enter Konnect.
5. When prompted to add a new data source to the collector, click OK.
6. Select HTTP Logs & Metrics.
7. In the Name field, enter Konnect.
8. Click OK.
9. Copy and save the SumoLogic endpoint URL.
10. In the SumoLogic sidebar, click Administration > Account Security Settings > Access Keys to create an access key.
11. Click Add Access Key.
12. In the Name field, enter Konnect.
13. Click Save.
14. Copy and save the SumoLogic access key.

If needed, configure your network’s firewall settings to allow traffic through the 8071 TCP or UDP port that Konnect uses for audit logging. See the Konnect ports and network requirements.

To complete this tutorial, you’ll need an audit log destination and webhook configured. If you don’t already have one configured, follow these steps:

1. In the Konnect sidebar, click Organization.
2. From the sidebar, click Audit Logs Setup.
3. On the Webhook Destination tab, click New Webhook.
4. In the Name field, enter SumoLogic.
5. In the Endpoint field, enter your external endpoint that will receive audit log messages. For example: https://endpoint4.collection.sumologic.com/receiver/v1/http/1234abcd.
6. In the Authorization Header field, enter the access token from you SIEM. Konnect will send this string in the Authorization header of requests to that endpoint.
7. From the Log Format dropdown menu, select “cef”.

8. (Optional) Click Disable SSL Verification to disable SSL verification of the host endpoint when delivering payloads.

   We only recommend disabling SSL verification when using self-signed SSL certificates in a non-production environment as this can subject you to man-in-the-middle and other attacks.

9. Click the Dev Portal tab.
10. Click New Dev Portal Audit Log.
11. From the View region dropdown menu, select the region.
12. From the Dev Portal dropdown menu, select your Dev Portal.
13. Click Enabled.
14. From the Endpoint dropdown menu, select your SIEM endpoint.
15. Click Save.

To validate that the webhook is configured correctly, you can log in to your Dev Portal with the account you created in the prerequisites. This should trigger a log in SumoLogic. Sometimes it can take a minute to populate the logs.