Copy the audit log into your SIEM

Send every change made in your organization, in the app or with a token, to your log platform once a day. The script reads yesterday's entries page by page and writes one JSON object per line, the format most log shippers read.

Runnable code: the code on this page, ready to clone and run, is in infranest-examples/examples/audit-log-to-siem. CI runs it against the sandbox.

The token

Make a token with Audit log → Read only. It can read the log and nothing else.

The script

#!/bin/sh
# Writes yesterday's audit log as JSON lines to audit-YYYY-MM-DD.jsonl.
set -eu
DAY=$(date -u -d yesterday +%Y-%m-%d)   # macOS: date -u -v-1d +%Y-%m-%d
URL="https://api.infranest.io/api/organizations/42/audit-logs?from=$DAY&to=$DAY&per_page=100"

: > "audit-$DAY.jsonl"
while [ -n "$URL" ] && [ "$URL" != "null" ]; do
  page=$(curl -fsS "$URL" -H "Authorization: Bearer $INFRANEST_TOKEN" -H "Accept: application/json")
  echo "$page" | jq -c '.data[]' >> "audit-$DAY.jsonl"
  URL=$(echo "$page" | jq -r .next_page_url)
done

Run it once a day, shortly after midnight UTC, and point your log shipper (Filebeat, Vector, the Splunk forwarder, …) at the files.

• from and to are dates (YYYY-MM-DD). Both are included.
• per_page goes up to 100. The answer is a page with data and a next_page_url, which is null on the last page.
• Each entry has the action (for example dns_record.updated), who did it (user), what it was about (resource_type, resource_id), the details in meta, and created_at. See the audit log reference.
• Filter with action (a part of the action name, such as dns_record) or resource_type.