[Yandex Cloud documentation](../../../index.md) > [Tutorials](../../index.md) > [Security](../index.md) > [Searching for events in audit logs](index.md) > Configuring Query

# Configuring Yandex Query

# Configuring Yandex Query


[Yandex Query](../../../query/index.md) supports Audit Trails. You can analyze events of Yandex Cloud resources by running [analytical](../../../query/concepts/batch-processing.md) and [streaming](../../../query/concepts/stream-processing.md) YQL queries.

You can run analytical queries for logs stored in a bucket, and streaming queries for logs stored in Yandex Data Streams.

![](../../../_assets/audit-trails/tutorials/audit-trails-query.png)

To connect a bucket with [audit logs](../../../audit-trails/concepts/events.md) to Yandex Query and run [YQL](../../../query/yql-tutorials/index.md) queries:

1. [Set up your environment](#prepare-environment).
1. [Create a connection between the trail and YQ](#trail-yq).
1. [Run a query to logs in Object Storage](#perform-request).

If you no longer need the resources you created, [delete them](#clear-out).


## Getting started {#before-begin}

Sign up for Yandex Cloud and create a [billing account](../../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../../billing/quickstart/index.md) and [link](../../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../../resource-manager/concepts/resources-hierarchy.md).

If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).


## Required paid resources {#paid-resources}

The cost of infrastructure support includes a fee for using the bucket (see [Object Storage pricing](../../../storage/pricing.md)).


## Set up your environment {#prepare-environment}


### Create a bucket for audit logs {#create-backet}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a [bucket](../../../storage/concepts/bucket.md), e.g., `example-folder`.
    1. Navigate to **Object Storage**.
    1. Click **Create bucket**.
    1. On the bucket creation page:
        * Enter a name for the bucket according to the [naming requirements](../../../storage/concepts/bucket.md#naming).
        * In the **Read objects**, **Read object list**, and **Read settings** fields, select `With authorization`.
        * Leave the other settings at their defaults.
    1. Click **Create bucket**.

{% endlist %}


### Create service accounts {#create-sa}

Create a service account named `trail-sa`:

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), navigate to `example-folder`.
    1. Navigate to **Identity and Access Management**.
    1. Click **Create service account**.
    1. Specify **Name**: `trail-sa`.
    1. Click **Create**.

{% endlist %}

Similarly, create a service account named `bucket-yq-sa`.


### Assign permissions to service accounts {#grant-roles}

Assign the `audit-trails.viewer` and `storage.uploader` roles to the `trail-sa` service account:

{% list tabs group=instructions %}

- CLI {#cli}
  
    1. The `audit-trails.viewer` role for your organization:

        ```bash
        yc organization-manager organization add-access-binding \
        --role audit-trails.viewer \
        --id <organization_ID> \
        --service-account-id <service_account_ID>
        ```

        Where `--service-account-id` is the `trail-sa` service account ID.

        Result:

        ```text
        done (1s)
        ```

        For more information about the `yc organization-manager organization add-access-binding` command, see the [CLI reference](../../../cli/cli-ref/organization-manager/cli-ref/organization/add-access-binding.md).

    1. The `storage.uploader` role for `example-folder`:

        ```bash
        yc resource-manager folder add-access-binding example-folder \
          --role storage.uploader \
          --subject serviceAccount:<service_account_ID>
        ```

        Where `--subject` is the `trail-sa` service account ID.

        Result:

        ```text
        done (1s)
        ```

        For more information about the `yc resource-manager folder add-access-binding` command, see the [CLI reference](../../../cli/cli-ref/resource-manager/cli-ref/folder/add-access-binding.md).

{% endlist %}

Assign the `storage.viewer` role for `example-folder` to the `bucket-yq-sa` service account:

{% list tabs group=instructions %}

- CLI {#cli}
  
    ```bash
    yc resource-manager folder add-access-binding example-folder \
        --role storage.viewer \
        --subject serviceAccount:<service_account_ID>
    ```

    Where `--subject` is the `bucket-yq-sa` service account ID.

    Result:

    ```text
    done (1s)
    ```

    For more information about the `yc resource-manager folder add-access-binding` command, see the [CLI reference](../../../cli/cli-ref/resource-manager/cli-ref/folder/add-access-binding.md).

{% endlist %}


## Create a trail {#create-trail}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select `example-folder`.
  1. Navigate to **Audit Trails**.
  1. Click **Create trail**.
  1. In the **Name** field, specify `logsyq`.
  1. Under **Destination**, configure the destination object:
      * **Destination**: `Object Storage`.
      * **Bucket**: Select the bucket you [created earlier](#create-backet).
  1. Under **Service account**, select `trail-sa`.
  1. Under **Collecting management events**, configure the collection of management event audit logs:

      * **Collecting events**: Select `Enabled`.
      * **Resource**: Select `Organization`.
      * **Organization**: Automatically populated field containing the name of the current organization.
      * **Cloud**: Keep the default value, `All`.

  1. Under **Collecting data events**, select `Disabled` in the **Collecting events** field.
  1. Click **Create**.

{% endlist %}


## Create a connection between the trail and YQ {#trail-yq}

You need to create a connection only when connecting the trail to YQ for the first time.

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select `example-folder`.
    1. Navigate to **Audit Trails**.
    1. Select the `logsyq` trail.
    1. Click **Process in YQ**.
    1. Create a connection:
        * Select the `bucket-yq-sa` **Service account**.
        * Leave the other settings at their defaults.
    1. Click **Create**.
    1. In the window with data binding options, click **Create**.

  This will take you to the page for creating a query to trail logs.

{% endlist %}


## Run a query to logs in Object Storage {#perform-request}

Open the page to create an analytical query to Audit Trails logs:

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the folder with your trail.
    1. Navigate to **Audit Trails**.
    1. Select the trail for which you configured a [connection to YQ](#trail-yq).
    1. Click **Process in YQ** to go to the analytical query execution page.

{% endlist %}

Run event queries for the `audit-trails-logsyq-object_storage` binding:

1. Deleting a folder:

    1. Select this query from the list: **1. Find out who deleted the folder**.
    1. Edit the query by specifying the folder ID:

        ```SQL
        SELECT * FROM bindings.`audit-trails-logsyq-object_storage`
        WHERE
            JSON_VALUE(data, "$.event_type") = 'yandex.cloud.audit.resourcemanager.DeleteFolder' 
            and JSON_VALUE(data, "$.details.folder_name") = '<folder_ID>' 
            LIMIT 100;
        ```

    1. Click **Execute**.

1. Enabling access via the serial console:

    1. Select this query from the list: **6. Changing a VM: Adding serial console access**.
    1. Edit the query by specifying the number of displayed records:

        ```SQL
        SELECT * FROM bindings.`<audit-trails-logsyq-object_storage>`
        WHERE
            JSON_VALUE(data, "$.event_type") = 'yandex.cloud.audit.compute.UpdateInstance' 
            and JSON_VALUE(data, "$.details.metadata_serial_port_enable") = '1' 
            LIMIT <number_of_records>;
        ```

    1. Click **Execute**.

1. Changing access permissions for an Object Storage bucket:

    1. Select this query from the list: **11. Suspicious activity with the Audit Trails log repository (Object Storage bucket)**.
    1. Edit the query by specifying the number of displayed records:

        ```SQL
        SELECT * FROM bindings.`audit-trails-logsyq-object_storage`
        WHERE
            (JSON_VALUE(data, "$.event_type") = 'yandex.cloud.audit.storage.BucketAclUpdate' 
            or JSON_VALUE(data, "$.event_type") = 'yandex.cloud.audit.storage.BucketPolicyUpdate') 
            LIMIT <number_of_records>;
        ```

    1. Click **Execute**.

1. Assigning admin permissions:

    1. Select this query from the list: **20. Assigning admin permissions (for a folder and cloud)**.
    1. Edit the query by specifying the number of displayed records:

        ```SQL
        SELECT * FROM bindings.`audit-trails-logsyq-object_storage`
        WHERE
            JSON_VALUE(data, "$.details.access_binding_deltas.access_binding.role_id") = 'admin' 
            LIMIT <number_of_records>;
        ```

    1. Click **Execute**.


## How to delete the resources you created {#clear-out}

If you created a separate bucket to complete this tutorial, you can [delete it](../../../storage/operations/buckets/delete.md) to stop paying a [bucket use](../../../storage/pricing.md) fee.