Sample Audit Log Notify

[adem_netsys]

Hello All,

We would like to receive audit log activities via email at specific intervals for specific users. When we tried using a notification rule, it only allowed us to select individual statuses. Has anyone tried this before? We are also open to hearing about any different notification rules you have used.

Thanks in advance

[jankit6]

Hello @adem_netsys 

Can you forward the logs using the 'Log Forwarding' option to a syslog server and then perform automation directly from there? Would that help?

[adem_netsys]

Actually, we can see the audit logs on SOAR. Can't we retrieve them via the API, or if there is an API endpoint, we could use a code snippet?

[sahirrao]

Hi @adem_netsys 
Kindly refer to the attached sample playbook, which is expected to satisfy your requirements.