Visualize Audits
Visualize audit data from Grey Matter using Kibana.
Last updated
Was this helpful?
1.2
Visualize audit data from Grey Matter using Kibana.
Last updated
Was this helpful?
This guide will help you leverage the Kibana dashboard to visualize your Grey Matter audit data.
To complete this tutorial, you’ll need an understanding of, and local access to the following environments and tools:
Unix/Linux setup
Microservices and mesh architecture
Grey Matter Sidecar - v0.7.2+
Grey Matter Discovery Service -v2.0.2
How to configure the Grey Matter Sidecar
Docker () - v17.03 and newer
Docker Compose ()
Kafka - v2.12-0 - 10.2.1
Elasticsearch
Kibana
When you've completed that guide, proceed to Step 2: Audit Proxy Observable Consumer (APOC).
The Audit Proxy Observable Consumer (APOC) reads from Kafka and submits the information to Elasticsearch asynchronously for maximum throughput.
APOC's goals include:
Listening to given Kafka topic(s)
Taking every event that is emitted into Kafka
Transforming those events
Submitting them to a given Elasticsearch index
When a message is transformed by the APOC, event mappings are also added. The message will default to the following HTTP types found below:
The message can also be changed for individual routes by adding the following settings:
During the transformation action_locations are added to the audit event. These consist of an IP address identifier based on the x-forwarded-for in the header of the request.
action_targets is added consisting of {x=forwarded-proto}://{:authority}{x-envoy-original-path}.
A creator is then added to the auditing payload, and follows these steps to determine its value.
Allow for configuring an override default to that in the environment variable or settings.yaml or JSON.
If there is a request header named application , use it.
See if there is a request header named service , use it.
Extrapolate the name if the request url contains /apps/{value}/ or /services/{value}/ x-envoy-original-path.
Hard code a default. For instance, you could use service if none of the previous parameters are set.
In this configuration, the transformation will try to find user information in the request header and set action_initiator to be the userdn from the request. time_audited is also added to the audit information. This is the system time at which the audit transformation is completed by the APOC. Finally, if a GEO_DATABASE is supplied, the transformation will try to find the geographical location of the request based on the last IP address in the x_forwarded_for header field. The full information is added to the audit information as geo_ip, but basic location (lat and long) is added as location.
Need help getting a dashboard up so you can visualize observables?
If you haven't already done so, complete our guide to help you with the Grey Matter Sidecar.
Create an account at to reach our team.