# Copy the audit log into your SIEM

Send every change made in your organization, in the app or with a token, to your log platform once a day. The
script reads yesterday's entries page by page and writes one JSON object per line, the format most log
shippers read.

**Runnable code:** the code on this page, ready to clone and run, is in [`infranest-examples/examples/audit-log-to-siem`](https://github.com/InfraNest-Infrastructure-Organized/infranest-examples/tree/main/examples/audit-log-to-siem). CI runs it against the [sandbox](../sandbox.md).

## The token

Make a token with **Audit log → Read** only. It can read the log and nothing else.

## The script

```sh
#!/bin/sh
# Writes yesterday's audit log as JSON lines to audit-YYYY-MM-DD.jsonl.
set -eu
DAY=$(date -u -d yesterday +%Y-%m-%d)   # macOS: date -u -v-1d +%Y-%m-%d
URL="https://api.infranest.io/api/organizations/42/audit-logs?from=$DAY&to=$DAY&per_page=100"

: > "audit-$DAY.jsonl"
while [ -n "$URL" ] && [ "$URL" != "null" ]; do
  page=$(curl -fsS "$URL" -H "Authorization: Bearer $INFRANEST_TOKEN" -H "Accept: application/json")
  echo "$page" | jq -c '.data[]' >> "audit-$DAY.jsonl"
  URL=$(echo "$page" | jq -r .next_page_url)
done
```

Run it once a day, shortly after midnight UTC, and point your log shipper (Filebeat, Vector, the Splunk
forwarder, …) at the files.

- **`from` and `to`** are dates (`YYYY-MM-DD`). Both are included.
- **`per_page`** goes up to 100. The answer is a page with `data` and a `next_page_url`, which is `null` on
  the last page.
- **Each entry** has the `action` (for example `dns_record.updated`), who did it (`user`), what it was about
  (`resource_type`, `resource_id`), the details in `meta`, and `created_at`. See the
  [audit log reference](/reference/audit-log).
- **Filter** with `action` (a part of the action name, such as `dns_record`) or `resource_type`.