Audit Logs

Overview

Abnormal Security's behavioral AI detects audit logs which can be sent via HTTP Listeners.

Configuration

Parameters

No parameters needed.

Secrets

• Authorization (abnormalToken)

Open the Secret fields and click New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

Learn more about secrets in Onum in this article.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the fields, or simply paste the given YAML:

Config as YAML

Toggle this ON to enable a free text field where you can paste your YAML.

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: RFC3339
withAuthentication: false
withEnumerationPhase: true
enumerationPhase:
  paginationType: "page"
  pageSize: 100
  isZeroIndex: false
  request:
    responseType: json
    method: GET
    url: https://api.abnormalplatform.com/v1/cases
    headers:
      - name: authorization
        value: Bearer ${secrets.abnormalToken}
    queryParams:
      - name: pageNumber
        value: "${pagination.pageNumber}"
      - name: pageSize
        value: "${pagination.pageSize}"
      - name: filter
        value: lastModifiedTime gte ${temporalWindow.from} lte ${temporalWindow.to}
  output:
    select: "[.cases[].caseId]"
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: caseId
      expression: "."
      format: ""
  paginationType: none
  request:
    method: GET
    url: https://api.abnormalplatform.com/v1/cases/${inputs.caseId}
    headers:
      - name: authorization
        value: Bearer ${secrets.abnormalToken}
  output:
    select: "."
    map: "."
    outputMode: element

Manually configure

This HTTP Pull Listener now uses the data export API to extract alert events.

Click Create labels to move on to the next step and define the required Labels if needed.