> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cognite.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up audit log streaming

> Step-by-step guide to configuring continuous delivery of Cognite Data Fusion (CDF) audit logs to Azure Blob Storage, Amazon S3, or Google Cloud Storage.

CDF can stream audit logs continuously to cloud storage you own and control. Once streaming is configured, new audit log entries are delivered to your storage destination as they are generated, giving you a queryable, long-term copy that you can feed into a security information and event management (SIEM) or analysis tool.

Setting up a stream is a two-part process: you create the storage destination and credentials in your cloud account, then share a configuration JSON securely with your Cognite representative, who completes the setup on the CDF side.

## Azure Blob Storage

<Steps>
  <Step title="Create a storage account and container">
    In Microsoft Azure, create a storage account and a container to receive the audit log files. See [Introduction to Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction) in the Microsoft documentation.
  </Step>

  <Step title="Generate a SAS token">
    From the [Azure portal](https://portal.azure.com):

    1. On the Home page, select **Storage accounts**.
    2. Under **Name**, select the storage account you want to use.
    3. Under **Data storage**, select **Containers**.
    4. Select the container you want to use.
    5. In the left sidebar, under **Settings**, select **Shared access tokens**.
    6. Open the **Permissions** dropdown and select **Create**, **Read**, **Add**, **List**, and **Write**. Deselect all other options.
    7. Set an expiry date that complies with your secret rotation policy.
    8. Select **Generate SAS token and URL**.
    9. Copy the value of the **Blob SAS URL** field. The URL has this format:

       ```
       https://{STORAGE_ACCOUNT}.blob.core.windows.net/{CONTAINER}?{SAS_TOKEN}
       ```
  </Step>

  <Step title="Build the configuration JSON">
    Create a JSON using the values from your SAS URL:

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      "TARGET_URL": "abfss://{CONTAINER}/audit-logs",
      "ORG": "{CUSTOMER_CDF_ORG_NAME}",
      "AZURE_STORAGE_ACCOUNT_NAME": "{STORAGE_ACCOUNT}",
      "AZURE_STORAGE_SAS_TOKEN": "{SAS_TOKEN}"
    }
    ```

    The `audit-logs` segment in `TARGET_URL` is the path within the container. You can request a different path when you contact your Cognite representative.
  </Step>

  <Step title="Share the configuration with Cognite">
    Send the JSON to your Cognite representative through a secure channel.
  </Step>
</Steps>

## Amazon S3

<Steps>
  <Step title="Create an S3 bucket">
    Create a bucket and block all public access to it. See [Creating, configuring, and working with Amazon S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-buckets-s3.html) in the AWS documentation.
  </Step>

  <Step title="Create an IAM policy">
    Create a policy that allows CDF to write to the bucket. Copy the following JSON and replace `EXAMPLE-BUCKET` with the name of your bucket:

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "s3:ListBucket",
          "Resource": "arn:aws:s3:::EXAMPLE-BUCKET",
          "Condition": {
            "StringLike": {
              "s3:prefix": "audit-logs/*"
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:ListBucket"
          ],
          "Resource": "arn:aws:s3:::EXAMPLE-BUCKET/audit-logs/*"
        }
      ]
    }
    ```

    The `audit-logs` segment in `s3:prefix` is the path within the bucket. You can request a different path when you contact your Cognite representative.

    See [Creating IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the AWS documentation.
  </Step>

  <Step title="Create an IAM user and access key">
    1. Create an IAM user and attach the policy you created directly to the user.
    2. Open the user and select **Create access key**.
    3. Copy the **Access key ID** and **Secret access key**.

    For more information, see [Understanding and getting your AWS credentials](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html) in the AWS documentation.
  </Step>

  <Step title="Build the configuration JSON">
    Create a JSON using the values from your bucket and IAM user:

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      "AWS_ACCESS_KEY": "{YOUR_IAM_USER_ACCESS_KEY}",
      "AWS_SECRET_ACCESS_KEY": "{YOUR_IAM_USER_ACCESS_KEY_SECRET}",
      "AWS_REGION": "{YOUR_S3_BUCKET_REGION}",
      "ORG": "{CUSTOMER_CDF_ORG_NAME}",
      "TARGET_URL": "s3://{NAME_OF_YOUR_BUCKET}/audit-logs/"
    }
    ```
  </Step>

  <Step title="Share the configuration with Cognite">
    Send the JSON to your Cognite representative through a secure channel.
  </Step>
</Steps>

## Google Cloud Storage

<Steps>
  <Step title="Create a Cloud Storage bucket">
    Create a new bucket in your Google Cloud project and enable **public access prevention** on it. See [Create buckets](https://cloud.google.com/storage/docs/creating-buckets) in the Google Cloud documentation.
  </Step>

  <Step title="Create a custom IAM role">
    The built-in **Storage Object User** role includes delete permissions that audit log delivery does not need. Create a custom role with only the permissions required:

    | Permission               | Purpose                         |
    | ------------------------ | ------------------------------- |
    | `storage.buckets.get`    | Access the bucket               |
    | `storage.objects.create` | Write new log files             |
    | `storage.objects.get`    | Read existing Delta log entries |
    | `storage.objects.list`   | List objects in the table path  |

    See [Create and manage custom roles](https://cloud.google.com/iam/docs/creating-custom-roles) in the Google Cloud documentation.
  </Step>

  <Step title="Create a service account and grant access">
    1. Create a service account in your Google Cloud project. See [Create service accounts](https://cloud.google.com/iam/docs/service-accounts-create) in the Google Cloud documentation.
    2. On the Cloud Storage bucket, grant the custom role you created to the service account. Grant the role at the **bucket level**, not the project level.
    3. Open the service account, go to the **Keys** tab, and select **Add key** → **Create new key**.
    4. Select **JSON** as the key type and download the key file.
  </Step>

  <Step title="Build the configuration JSON">
    Create a JSON in the following format. Set `GCS_SERVICE_ACCOUNT_KEY` to the entire contents of the downloaded key file as a single-line string:

    ```json theme={"languages":{"custom":["/_languages/kuiper.json","../_languages/kuiper.json"]}}
    {
      "ORG": "{CUSTOMER_CDF_ORG_NAME}",
      "TARGET_URL": "gs://{NAME_OF_YOUR_BUCKET}/audit-logs",
      "GCS_SERVICE_ACCOUNT_KEY": "{SERIALIZED_JSON_KEY}"
    }
    ```

    The `audit-logs` segment in `TARGET_URL` is the path within the bucket. You can request a different path when you contact your Cognite representative.
  </Step>

  <Step title="Share the configuration with Cognite">
    Send the JSON to your Cognite representative through a secure channel.
  </Step>
</Steps>

***

## Further reading

* [About CDF audit logs](/cdf/admin/audit/about) — Schema and delivery overview
* [Audit log query reference](/cdf/admin/audit/queries) — Query the logs you are streaming
* [Audit log event types reference](/cdf/admin/audit/event-types) — All `serviceName` and `eventType` values