[Yandex Cloud documentation](../../index.md) > [Yandex Data Streams](../index.md) > [Tutorials](index.md) > Processing Audit Trails events

# Processing Yandex Audit Trails events

Yandex Audit Trails is a service for collecting and exporting audit logs of Yandex Cloud resources to various target systems, including Yandex Object Storage and Yandex Data Streams. Audit Trails and Yandex Query work together to enable searching through audit logs.

![image](../../_assets/query/audit-trails-query.png)

Using Query to process audit logs allows you to get the following information:

* Who deleted a cloud folder.
* Who enabled access to a Yandex Compute Cloud VM serial console.
* Who edited access permissions for an Object Storage bucket.
* Who was granted admin privileges.

You can find the preset queries for these use cases in [this GitHub repository](https://github.com/yandex-cloud/yc-solution-library-for-security/tree/master/auditlogs/_use_cases_and_searches). You can also write custom [YQL queries](../../query/yql-tutorials/index.md).

In this use case, you will create [trails](../../audit-trails/concepts/trail.md) that will upload audit logs of all [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) resources to the Object Storage [bucket](../../storage/concepts/bucket.md) and send them to the [stream](../concepts/glossary.md#stream-concepts) in Data Streams. Next, you will run analytical and streaming queries to the log data using Query.

## Getting started {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).

## Configure Audit Trails {#at-setup}

[Create two trails](../../audit-trails/operations/create-trail.md):

* To upload folder audit logs to the Object Storage bucket.
* To send folder audit logs to the stream in Data Streams.

## Set up integration between Audit Trails and Query {#integration}


To set up integration:

1. Open the list of trails in the Yandex Cloud console.
1. Select the trail you previously created for uploading cloud audit logs to the bucket and click **Process in YQ**.
1. When switching from Audit Trails to Query for the first time, set up integration:
   1. In the Query interface, select the service account you want to use to read data from Object Storage in the connection creation dialog and click **Create**.
   1. In the Query interface, check the preset parameters by clicking **Preview** in the binding creation dialog. Next, click **Create** to complete the integration.

This will automatically redirect you to the **Audit trails** panel of the Query interface.

Perform similar actions for the previously created trail for sending data to the stream in Data Streams.

## Analytical queries to Object Storage data

To query Audit Trails analytical data stored in Object Storage:

1. Under **Audit trails** in the Query interface, select **Analytical** as the data analysis type. In the list of [data bindings](../../query/concepts/glossary.md#binding), select `audit-trails-test-object_storage`.
1. Select the query to Object Storage data from the list and click **Run**.

You can do the following with analytical query results:

* Download them through the Query user interface by clicking **Export**.
* [Save them to an Object Storage bucket](../../query/sources-and-sinks/object-storage-write.md).
* Get and process them via the [Query HTTP API](../../query/api/index.md).
<!-- * [Visualize them](../../query/tutorials/datalens.md) in Yandex DataLens. -->

## Streaming queries to Data Streams data


To query Audit Trails streaming data transferred through Data Streams:

1. Under **Audit trails** in the **Yandex Query** interface, select **Streaming** as the data analysis type. In the list of [data bindings](../../query/concepts/glossary.md#binding), select the one you need.
1. Select the query to Object Storage data from the list and click **Run**.

You can do the following with streaming query results:

* [Send them to Yandex Monitoring](../../query/sources-and-sinks/monitoring.md) as metrics.
* [Send them to an output stream in Data Streams](../../query/sources-and-sinks/data-streams-write.md) as data and then process the data using [Yandex Cloud Functions triggers](../../functions/operations/trigger/data-streams-trigger-create.md).

#### Useful links {#see-also}

* [Yandex Object Storage](../../storage/index.md)
* [Yandex Data Streams](../index.md)
* [Yandex DataLens](../../datalens/index.md)