How to Export Audit Logs for Dex Platform Using ControlUp APIs and Workflows

The topic of exporting Audit Logs for the Dex platform arose in Slack, and several members provided possible solutions using ControlUp APIs and workflows. The API article can be found at https://api.controlup.io/reference/orgauditlogpubliccontroller_getall and events overview can be found at https://support.controlup.com/docs/incidents-and-events-overview?highlight=Vdi%20event. The user was looking to export the logs to a different location, specifically Azure Sentinel.

Read the entire ‘How to Export Audit Logs for Dex Platform Using ControlUp APIs and Workflows’ thread below:

I know we can point the VDI DaaS Audit Logs to a syslog server, but I would like to export Audit Logs for the Dex platform (specifically the physical endpoint module) to a centralized location. Is this possible?

Are you taking the actions inside of the web console? Or the actions found in the executable?

Yes you can do this with our Dex APIs. Do you need the KB article?

I am looking to export logs of actions occurring in the web console. So if a user logs in with SAML and tries to use the remote shell, for example, it places it in the DEX audit log.

@member I found an API article for that… I think. Looks like there is a way to export to a different format but not sure if it will work for our ingest. https://api.controlup.io/reference/orgauditlogpubliccontroller_getall

@member are these the ones you are looking for? https://support.controlup.com/docs/incidents-and-events-overview?highlight=Vdi%20event

You would like to export these into a different location?

The DEX audit logs here:

Go to the new events section, VDI is there as well. Filter for VDI

I believe those actions should be there too if I am not mistaken…

@member – Looks like there is a way to export to a different format but not sure if it will work for our ingest. might be something in workflows that can help you with this – @member @member Is the API for this exposed or planed? @member what are you trying to send the logs to. what solution? might be some integration already for it in workflows

Our internal security team would like it ingested to Azure Sentinel.

Continue reading and comment on the thread ‘How to Export Audit Logs for Dex Platform Using ControlUp APIs and Workflows’.  Not a member? Join Here!