Collect Atlassian Cloud Admin Audit logs

This document explains how to ingest Atlassian Cloud Admin Audit logs to Google Security Operations using AWS S3. The parser first attempts to process the incoming message as a JSON object. If that fails, it uses regular expressions (Grok patterns) to extract fields from various Atlassian Jira log formats, ultimately mapping the extracted data to the unified data model (UDM).

Before you begin

Make sure you have the following prerequisites:

• Google SecOps instance
• Privileged access to AWS
• Privileged access to Atlassian

Configure AWS IAM and S3 Bucket

1. Create an Amazon S3 bucketfollowing this user guide: Creating a bucket
2. Sign in to the AWS Console.
3. Go to S3 > Create bucket.
4. Provide a name for the bucket (for example, atlassian-admin-audit-logs ).
5. Leave other defaults (or configure encryption and versioning if required).
6. Click Create.
7. Save the bucket Nameand Regionfor future reference.
8. Create a Userfollowing this user guide: Creating an IAM user .
9. Select the created User.
10. Select the Security credentialstab.
11. Click Create Access Keyin the Access Keyssection.
12. Select Third-party serviceas Use case.
13. Click Next.
14. Optional: Add a description tag.
15. Click Create access key.
16. Click Download CSV fileand store the Access IDand Secret Access Keyfor future reference.
17. Click Done.
18. In the Permissionstab under Permissions policies, click Add permissions.
19. Select Attach policies directly.
20. Search for AmazonS3FullAccesspolicy.
21. Select the policy.
22. Click Next.
23. Click Add permissions.

Configure API Key in Atlassian

1. Sign in to Atlassian .
2. Go to Settings > API keys.
3. Click Create API keyin the top right.
4. Provide a unique and descriptive namefor the Key.
5. Pick a new expiration date under Expires on.

1. Click Createto save.
2. Copy and save your API Keyand Organization ID.
3. Click Done.

Configure the required packages

1. Sign in to your log collection host (for example, an AWS VM) and run the following to configure AWS credentials:

    pip  
   install  
   boto3  
   requests
   aws  
   configure 
   

Create Atlassian Log Puller script

1. Create the following file by entering sudo vi area1_to_s3.py and copy the following code:

   • Adjust the following:

     #!/usr/bin/env python3 
    import 
     
    os 
    , 
     
    requests 
    , 
     
    boto3 
    , 
     
    datetime 
    # Settings 
    TOKEN 
    = 
    os 
    . 
    environ 
    [ 
    "ATL_TOKEN" 
    ] 
    ORG_ID 
    = 
    os 
    . 
    environ 
    [ 
    "ATL_ORG_ID" 
    ] 
    AWS_PROFILE 
    = 
    os 
    . 
    getenv 
    ( 
    "AWS_PROFILE" 
    ) 
    BUCKET 
    = 
    "atlassian-admin-audit-logs" 
    def 
     
    fetch_events 
    ( 
    cursor 
    = 
    None 
    ): 
    url 
    = 
    f 
    "https://api.atlassian.com/admin/v1/orgs/ 
    { 
    ORG_ID 
    } 
    /events" 
    headers 
    = 
    { 
    "Authorization" 
    : 
    f 
    "Bearer 
    { 
    TOKEN 
    } 
    " 
    } 
    params 
    = 
    { 
    "limit" 
    : 
    100 
    , 
    "cursor" 
    : 
    cursor 
    } 
    if 
    cursor 
    else 
    { 
    "limit" 
    : 
    100 
    } 
    resp 
    = 
    requests 
    . 
    get 
    ( 
    url 
    , 
    headers 
    = 
    headers 
    , 
    params 
    = 
    params 
    ) 
    resp 
    . 
    raise_for_status 
    () 
    return 
    resp 
    . 
    json 
    () 
    def 
     
    upload_json 
    ( 
    data 
    , 
    filename 
    ): 
    session 
    = 
    boto3 
    . 
    Session 
    ( 
    profile_name 
    = 
    AWS_PROFILE 
    ) 
    if 
    AWS_PROFILE 
    else 
    boto3 
    . 
    Session 
    () 
    session 
    . 
    client 
    ( 
    "s3" 
    ) 
    . 
    put_object 
    ( 
    Bucket 
    = 
    BUCKET 
    , 
    Key 
    = 
    filename 
    , 
    Body 
    = 
    data 
    , 
    ContentType 
    = 
    "application/json" 
    ) 
    print 
    ( 
    f 
    "Uploaded 
    { 
    filename 
    } 
    " 
    ) 
    def 
     
    main 
    (): 
    today 
    = 
    datetime 
    . 
    datetime 
    . 
    utcnow 
    () 
    . 
    strftime 
    ( 
    "%Y-%m- 
    %d 
    " 
    ) 
    cursor 
    = 
    None 
    count 
    = 
    0 
    while 
    True 
    : 
    resp 
    = 
    fetch_events 
    ( 
    cursor 
    ) 
    key 
    = 
    f 
    "audits/ 
    { 
    today 
    } 
    /events_ 
    { 
    count 
    } 
    .json" 
    upload_json 
    ( 
    resp 
    [ 
    "data" 
    ], 
    key 
    ) 
    count 
    += 
    1 
    cursor 
    = 
    resp 
    . 
    get 
    ( 
    "links" 
    ,{}) 
    . 
    get 
    ( 
    "next" 
    ) 
    if 
    not 
    cursor 
    : 
    break 
    if 
    __name__ 
    == 
    "__main__" 
    : 
    main 
    () 
    
   

2. Save and exit vi by clicking esc > type :wq **.

Store environment variables

1. Create a secure file to store environment variables in /etc/atlassian_audit.env :

     export 
     
    ATL_TOKEN 
    = 
    "your_atlassian_key" 
    export 
     
    ATL_ORG_ID 
    = 
    "your_org_id" 
    export 
     
    AWS_PROFILE 
    = 
    "atlassian-logs" 
    
   

2. Make sure the file is secure:

    chmod  
    600 
     
   /etc/atlassian_audit.env 
   

Automate with Cron

1. Create a Wrapper script for Cron by running sudo vi /usr/local/bin/run_atlassian_audit.sh and then copy the following code:

     #!/usr/bin/env bash 
    source 
     
   /etc/atlassian_audit.env
   python3  
   /opt/scripts/export_atlassian_audit.py 
   

2. Make the file executable:

    chmod  
   +x  
   /usr/local/bin/run_atlassian_audit.sh 
   

3. Configure to run daily at 02:00 UTC:

    crontab  
   -e 0 
     
    2 
     
   *  
   *  
   *  
   /usr/local/bin/run_atlassian_audit.sh >> 
   /var/log/atl_audit.log  
    2>&1 
    
   

Need more help? Get answers from Community members and Google SecOps professionals.