[Yandex Cloud documentation](../../../index.md) > [Yandex Audit Trails](../../index.md) > [Tutorials](../index.md) > Exporting audit logs to SIEM systems > [Exporting audit logs to MaxPatrol SIEM](index.md) > Terraform

# Exporting audit logs to MaxPatrol SIEM using Terraform


[MaxPatrol SIEM](https://www.ptsecurity.com/ru-ru/products/mpsiem/) enables reading Yandex Cloud [audit logs](../../concepts/events.md) from a data stream in [Yandex Data Streams](../../../data-streams/index.md). To complete this tutorial, you need access to a MaxPatrol SIEM instance.

To set up audit log export using Terraform:

1. [Get your cloud ready](#before-you-begin).
1. [Deploy the infrastructure for audit log export to MaxPatrol SIEM](#deploy).
1. [In MaxPatrol SIEM, set up a task to collect data from the stream in Data Streams](#configure-maxpatrol).

If you no longer need the resources you created, [delete them](#clear-out).

## Get your cloud ready {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../../billing/quickstart/index.md) and [link](../../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../../resource-manager/concepts/resources-hierarchy.md).

### Required paid resources {#paid-resources}

The cost of support for the new infrastructure includes:
* Using a data stream (see [Data Streams pricing](../../../data-streams/pricing.md)).
* Using Yandex Managed Service for YDB in serverless mode (see [Managed Service for YDB pricing](../../../ydb/pricing/serverless.md)).

## Deploy the infrastructure for audit log export to MaxPatrol SIEM {#deploy}

With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.

For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

To create an infrastructure using Terraform:
1. [Install Terraform](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform), [get the credentials](../../../tutorials/infrastructure-management/terraform-quickstart.md#get-credentials), and specify the source for installing Yandex Cloud (see [Configure your provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#configure-provider), step 1).
1. Set up your infrastructure description files:

    {% list tabs group=infrastructure_description %}

    - Ready-made configuration {#ready}

      1. Clone the repository with configuration files:

         ```bash
         git clone https://github.com/yandex-cloud-examples/yc-export-audit-logs-maxpatrol
         ```

      1. Navigate to the repository directory. It should now contain the following files:
          * `audit-trails-maxpatrol-export.tf`: New infrastructure configuration file.
          * `audit-trails-maxpatrol-export.auto.tfvars`: File with the values of user-defined variables.

    - Manually {#manual}

      1. Create a folder for configuration files. In this folder:

          1. Create a configuration file named `audit-trails-maxpatrol-export.tf`:

              {% cut "**audit-trails-maxpatrol-export.tf**" %}

              ```hcl
              # Declaring variables
              
              variable "folder_id" {
                type = string
              }
              
              variable "organization_id" {
                type = string
              }
              
              locals {
                sa_name        = "maxpatrol-sa"
                sa_reader_name = "maxpatrol-reader-sa"
                db_name        = "maxpatrol-db"
                yds_name       = "maxpatrol-stream"
                trail_name     = "maxpatrol-trail"
              }
              
              # Configuring the provider
              
              terraform {
                required_providers {
                  yandex = {
                    source = "yandex-cloud/yandex"
                  }
                }
                required_version = ">= 0.13"
              }
              
              provider "yandex" {
                folder_id = var.folder_id
              }
              
              # Creating service accounts
              
              resource "yandex_iam_service_account" "maxpatrol-sa" {
                name = local.sa_name
              }
              
              resource "yandex_iam_service_account" "maxpatrol-reader-sa" {
                name = local.sa_reader_name
              }
              
              # Assigning roles to service accounts
              
              resource "yandex_resourcemanager_folder_iam_member" "yds-writer" {
                folder_id = var.folder_id
                role      = "yds.writer"
                member    = "serviceAccount:${yandex_iam_service_account.maxpatrol-sa.id}"
              }
              
              resource "yandex_resourcemanager_folder_iam_member" "yds-viewer" {
                folder_id = var.folder_id
                role      = "yds.viewer"
                member    = "serviceAccount:${yandex_iam_service_account.maxpatrol-reader-sa.id}"
              }
              
              resource "yandex_organizationmanager_organization_iam_binding" "audit-trails-viewer" {
                organization_id   = var.organization_id
                role              = "audit-trails.viewer"
                members = [
                  "serviceAccount:${yandex_iam_service_account.maxpatrol-sa.id}",
                ]
              }
              
              # Creating a static access key for the service account
              
              resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
                service_account_id = yandex_iam_service_account.maxpatrol-reader-sa.id
              }
              
              # Creating a serverless YDB
              
              resource "yandex_ydb_database_serverless" "maxpatrol-db" {
                name        = local.db_name
                folder_id   = var.folder_id
                sleep_after = 90
              }
              
              # Creating a YDB topic: Data Streams
              
              resource "yandex_ydb_topic" "data-streams" {
                database_endpoint = yandex_ydb_database_serverless.maxpatrol-db.ydb_full_endpoint
                name              = local.yds_name
              }
              
              # Wait until the topic is created before creating the trail.
              
              resource "time_sleep" "wait-for-topic" {
                depends_on      = [yandex_ydb_topic.data-streams]
                create_duration = "20s"
              }
              
              # Creating a trail
              
              resource "yandex_audit_trails_trail" "maxpatrol-trail" {
                depends_on = [time_sleep.wait-for-topic]
                name                = local.trail_name
                folder_id           = var.folder_id
                service_account_id  = yandex_iam_service_account.maxpatrol-sa.id
              
                data_stream_destination {
                  database_id = yandex_ydb_database_serverless.maxpatrol-db.id
                  stream_name = local.yds_name
                }
              
                filtering_policy {
                  management_events_filter {
                    resource_scope {
                      resource_id   = var.organization_id
                      resource_type = "organization-manager.organization"
                    }
                  }
                }
              }
              
              output "static-access-key" {
                sensitive = true
                value = yandex_iam_service_account_static_access_key.sa-static-key.access_key
              }
              
              output "static-secret-key" {
                sensitive = true
                value = yandex_iam_service_account_static_access_key.sa-static-key.secret_key
              }
              
              output "database-id" {
                sensitive = true
                value = yandex_ydb_database_serverless.maxpatrol-db.id
              }
              ```

              {% endcut %}

          1. Create a file with user data named `audit-trails-maxpatrol-export.auto.tfvars`:

              **audit-trails-maxpatrol-export.auto.tfvars**

              ```hcl
              folder_id       = "<folder_ID>"
              organization_id = "<organization_ID>"
              ```

    {% endlist %}

    For more information about Terraform resource parameters, see the relevant provider guides:

    * [Service account](../../../iam/concepts/users/service-accounts.md): [yandex_iam_service_account](../../../terraform/resources/iam_service_account.md).
    * [Role](../../../iam/concepts/access-control/roles.md) assigned to the service account for the folder: [yandex_resourcemanager_folder_iam_member](../../../terraform/resources/resourcemanager_folder_iam_member.md).
    * Role assigned to the service account for the organization: [yandex_organizationmanager_organization_iam_binding](../../../terraform/resources/organizationmanager_organization_iam_binding.md).
    * [Static access key](../../../iam/concepts/authorization/access-key.md): [yandex_iam_service_account_static_access_key](../../../terraform/resources/iam_service_account_static_access_key.md).
    * [Serverless database (YDB)](../../../ydb/concepts/serverless-and-dedicated.md#serverless): [yandex_ydb_database_serverless](../../../terraform/resources/ydb_database_serverless.md).
    * [Data stream in Yandex Data Streams](../../../data-streams/concepts/glossary.md#stream-concepts): [yandex_ydb_topic](../../../terraform/resources/ydb_topic.md).
    * [Trail](../../concepts/trail.md): [yandex_audit_trails_trail](../../../terraform/resources/audit_trails_trail.md).

1. In the `audit-trails-maxpatrol-export.auto.tfvars` file, set the values of the user-defined variables:
    * `folder_id`: [Folder ID](../../../resource-manager/operations/folder/get-id.md).
    * `organization_id`: [ID of the organization](../../../organization/operations/organization-get-id.md) to create the trail and store audit logs in.

1. Create the resources:

    1. In the terminal, navigate to the configuration file directory.
    1. Make sure the configuration is correct using this command:
    
       ```bash
       terraform validate
       ```
    
       If the configuration is valid, you will get this message:
    
       ```bash
       Success! The configuration is valid.
       ```
    
    1. Run this command:
    
       ```bash
       terraform plan
       ```
    
       You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
    1. Apply the configuration changes:
    
       ```bash
       terraform apply
       ```
    
    1. Type `yes` and press **Enter** to confirm the changes.

    This will create and configure all the required infrastructure in the folder you selected.

1. Get the static access key ID and secret key, as well as the ID of the database you created; you will need them later to configure MaxPatrol SIEM. Do it by running these commands:

    ```bash
    echo "Static access key: $(terraform output static-access-key)"
    echo "Secret key: $(terraform output static-secret-key)"
    echo "YDB database ID: $(terraform output database-id)"
    ```

    Result:

    ```text
    Static access key: "YCAJEnmnfsV8GpAMk********"
    Secret key: "YCMVxx-n0t8Y6s48zJDdKw9lWMB1iGU-********"
    YDB database ID: "etnvs692elpn********"
    ```

## Configure MaxPatrol SIEM {#configure-maxpatrol}

### Create credentials {#static-key-account}

You can use credentials to store secrets. Create credentials named `static-key-id` and `static-key-private` to host the ID and secret access key for the `maxpatrol-reader-sa` service account:

1. Log in to the MaxPatrol SIEM web interface.
1. Under **Data collection**, click **Credentials**.
1. Click **Add credential** → **Password** and specify the following:
    * **Name**: `static-key-id`.
    * **Password**: Static key ID.
    * **Confirm password**: Reenter static key ID.
1. Click **Save**.

Similarly, create a credential named `static-key-private` containing the secret key.


### Create a data collection task {#create-task}

Create and run a data collection task with the Yandex Data Streams profile:
1. Log in to the MaxPatrol SIEM web interface.
1. Under **Data collection**, click **Tasks**.
1. On the **Data collection tasks** page:
    1. In the toolbar, click **Create task**.
    1. Click **Data collection**.
1. On the **Create data collection task** page, specify the following parameters:
    1. **Name**: `YDS-logs-task`.
    1. **Profile**: `Yandex Data Streams`.
    1. In the hierarchy list, select **Run script**.
    1. Under **Connection**, specify:
        * **Credentials**: `static-key-id`.
        * **Credentials for privilege elevation**: `static-key-private`.
    1. **Script settings**:
        * **database**: `<maxpatrol-db_ID>`;
        * **folder**: `<cloud_ID_for_example-folder>`;
        * **region_name**: `ru-central1`.
        * **stream_name**: `maxpatrol-stream`.
    1. In the **Data collection targets** panel:
        1. Select the **Include** tab.
        1. In the **Network addresses** field, enter `yandex-cloud`.
    1. Click **Save and run**.

To view logs, go to the events page:
1. Go the to the **Data collection tasks** page.
1. Click `YDS-logs-task`.
1. Click **Collected events** → **Select**.

## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:

1. Open the `audit-trails-maxpatrol-export.tf` file and delete your infrastructure description from it.
1. Apply the changes:

    1. In the terminal, navigate to the configuration file directory.
    1. Make sure the configuration is correct using this command:
    
       ```bash
       terraform validate
       ```
    
       If the configuration is valid, you will get this message:
    
       ```bash
       Success! The configuration is valid.
       ```
    
    1. Run this command:
    
       ```bash
       terraform plan
       ```
    
       You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
    1. Apply the configuration changes:
    
       ```bash
       terraform apply
       ```
    
    1. Type `yes` and press **Enter** to confirm the changes.

#### Useful links {#see-also}

* [Exporting audit logs to MaxPatrol SIEM using the management console or Yandex Cloud CLI](console.md)