The document summarizes a presentation on designing and implementing an integration between the Anypoint Platform audit logs and Splunk. The presentation covers the Anypoint Platform audit logs features, the audit log query API, a proposed solution to integrate the audit logs with Splunk using that API, and a demo of the integration. It also notes the rate limiting and data retention policies for the audit logs.

1. June 2023
Wellington MuleSoft Meetup Group
DESIGN AND IMPLEMENTATION:
ANYPOINT PLATFORM AUDIT LOGS SPLUNK
INTEGRATION
Please introduce yourself to the chat…

2. Speakers
https://www.linkedin.com/in/gopalb264/ https://www.linkedin.com/in/mary-joy-sabal/
SPEAKER
Gopal
Bhumireddy
Senior MuleSoft
Developer,
DXC
Technology
SPEAKER
Mary Joy Sabal
Advisor Solution
Architect,
DXC Technology

3. 3
● Problem Statement
● Audit Logs Query API (Anypoint Platform)
● Proposed Solution
● Demo
● Key Takeaways
Agenda

4. Out of scope / Exclusions
● Splunk Enterprise Security
● Disabling Cloudhub logs due to trial account
● MuleSoft Operational Logs
4

5. Problem Statement / Business
Challenges

6. Business Challenges
6

7. Audit Logging

8. Audit Logs
● Changes made by users within Anypoint Platform organizations are logged through an audit
logging service.
● Provides a queryable history of actions performed within the Anypoint Platform.
● Keeps track of all users who have interacted with objects in the system and timestamps those
actions.
● Provides mechanisms for querying the set of users who have performed actions, the set of
objects that had actions performed on them, and other endpoints that enable the querying of
log entries.
● Users who have the Organization Administrator permission or the Audit Log Viewer
permission on Anypoint Platform have access to both the UI and the Query API.
● Business-group aware, which means you see only logs that are relevant to your own business
group.
8

9. Audit Log Query API
9
https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/audit-log-query-api/

10. Audit Log Contents
Each log entry has a set of properties that provides information about the activity:
o Time: The timestamp when the activity occurred.
o Product: The product where the object resides, for example, Access Management
o Type: The type of the object on which the action is performed, for example, Organization
o Action: The action associated with the object, for example, Create
o Object: The name of the object, for example, foo
o User Name: The user who performed the action, for example, johndoe
o Connected App: Name of the connected app that takes an action on behalf of a user or itself. If a connected app did
not execute the action, the payload is N/A.
o Environment: Environment names for events from API Manager, Runtime Manager, CloudHub, Partner Manager,
and MQ.
o Parent: (Optional) The parent of the object (if any) on which the action is performed. Mainly relevant to APIs.
o Payload: (Optional) More information about the log properties. For example, if an Organization was created, then the
payload would contain information about the organization and the owner, such as IDs.
10

11. Rate Limit Policy for Audit Log Query Endpoint
● If a client exceeds the rate limit for a given control plane, the Audit Log Query endpoint returns
a 503 Service Unavailable status code until the minute expires. During this time, the service is
unavailable to the client.
● MuleSoft recommends that users of the Audit Log Query Endpoint monitor their request rates
and adjust their usage accordingly to avoid exceeding the rate limit. Note that exceeding the
rate limit may result in the endpoint being temporarily unavailable.
11
Control Plane Allowed requests per minute per IP
US 700
EU 40
Gov 40

12. Audit Log Retention Period
● Default retention period of six years.
● Users who have Audit Log Config Manager and Organization Administrator permissions can
configure the retention period for the audit logs in their organization.
● Download your logs periodically if you want to maintain your log files for longer than six years
or build a custom API to send the audit logs to external monitoring tool like Splunk.
● When you configure a retention period: https://docs.mulesoft.com/access-management/audit-
log-retention#configure-audit-log-retention-period
 You can specify a retention period between 30 and 2190 days.
 The date the new retention period takes effect must be a minimum of seven days from the
current date.
 Configuring a new retention period affects your organization’s compliance policy.
12

13. Proposed Solution

14. Conceptual Diagram
14

15. Sequence Diagram
15

16. Demo

17. Pre-requisites
● Splunk Cloud trial account or standalone installed on your local machine.
● Anypoint Platform trial account
17

19. Key Takeaways

20. Feel free to reach
out!
https://www.linkedin.com/in/gopalb264/ https://www.linkedin.com/in/mary-joy-sabal/
SPEAKER
Gopal
Bhumireddy
Senior MuleSoft
Developer,
DXC
Technology
SPEAKER
Mary Joy Sabal
Advisor Solution
Architect,
DXC Technology