Recover Konnect audit logs

If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

1. The following Konnect items are required to complete this tutorial:
   • Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

2. Set the personal access token as an environment variable:

   export KONNECT_TOKEN='YOUR KONNECT TOKEN'
   

   Copied!

To recover audit logs, you need the Admin role for audit logs.

To use the audit log webhook, you need a configured SIEM provider. In this tutorial, we’ll use SumoLogic, but you can use any SIEM provider that supports the ArcSight CEF Format or raw JSON. Konnect supports any HTTP authorization header type.

Before you can push audit logs to your SIEM provider, configure the service to receive logs. This configuration is specific to your vendor.

In this tutorial, we’ll configure an HTTPS data collector and source in SumoLogic.

1. In the SumoLogic sidebar, click Data Management > Collection.
2. Click Add Collector.
3. Click Hosted Collector.
4. In the Name field, enter Konnect.
5. When prompted to add a new data source to the collector, click OK.
6. Select HTTP Logs & Metrics.
7. In the Name field, enter Konnect.
8. Click OK.
9. Copy and save the SumoLogic endpoint URL.
10. In the SumoLogic sidebar, click Administration > Account Security Settings > Access Keys to create an access key.
11. Click Add Access Key.
12. In the Name field, enter Konnect.
13. Click Save.
14. Copy and save the SumoLogic access key.

If needed, configure your network’s firewall settings to allow traffic through the 8071 TCP or UDP port that Konnect uses for audit logging. See the Konnect ports and network requirements.

To complete this tutorial, you’ll need an audit log destination and webhook configured. If you don’t already have one configured, follow these steps:

1. In the Konnect sidebar, click Organization.
2. From the sidebar, click Audit Logs Setup.
3. On the Webhook Destination tab, click New Webhook.
4. In the Name field, enter SumoLogic.
5. In the Endpoint field, enter your external endpoint that will receive audit log messages. For example: https://endpoint4.collection.sumologic.com/receiver/v1/http/1234abcd.
6. In the Authorization Header field, enter the access token from you SIEM. Konnect will send this string in the Authorization header of requests to that endpoint.
7. From the Log Format dropdown menu, select “cef”.

8. (Optional) Click Disable SSL Verification to disable SSL verification of the host endpoint when delivering payloads.

   We only recommend disabling SSL verification when using self-signed SSL certificates in a non-production environment as this can subject you to man-in-the-middle and other attacks.

9. Click the Konnect tab.
10. Navigate to the region you want to configure the webhook for.
11. Click Disabled.
12. From the Endpoint dropdown menu, select your SIEM endpoint.
13. Click Save.

To validate that the webhook is configured correctly, send an API request using the Konnect API:

 curl -X GET "https://us.api.konghq.com/v2/control-planes" \
     -H "Authorization: Bearer $KONNECT_TOKEN"

This triggers a log in SumoLogic. Sometimes it can take a minute to populate the logs.