# Audit Logs

Collects and ingests audit log events from the Abnormal Security portal, providing visibility into user logins, API calls, configuration changes, remediation actions, and other administrative activity in your Abnormal tenant.

**Sync Type: Incremental**

## Prerequisites

Before connecting Monad to Abnormal Security, you need:

1. An active Abnormal Security tenant with permission to manage API integrations
2. An Abnormal Security REST API key
3. Monad's egress IP addresses added to the Abnormal IP allowlist

## Setup Instructions

### 1. Generate an Abnormal Security API Key

1. **Log in to the Abnormal portal**:
   - Sign in at your tenant's Abnormal Security portal URL

2. **Navigate to the Integrations area**:
   - Go to **Settings** → **Integrations**
   - Open the **REST API** integration tile

3. **Create an API Key**:
   - Click **Generate API Key** (or **Create Token**)
   - Provide a descriptive name (e.g., "Monad Audit Logs Connector")
   - Copy the generated token immediately — it cannot be retrieved later
   - **Important**: Store the API key securely. Never commit it to version control.

### 2. Identify Your Tenant's API Base URL

The Abnormal API base URL is region-specific.

1. In the Abnormal portal, go to **Settings** → **Integrations** → **REST API**
2. Note the base URL listed for your tenant (for example, `https://api.abnormalplatform.com`)

### 3. Allowlist Monad Egress IPs

Abnormal requires API clients to be on an allowlist. Provide the following IPs to your Abnormal administrator or Abnormal support:

- **Monad SaaS**: see [Monad egress IP addresses](../../guides/egress-ip-addresses.mdx)
- **Monad on-premises**: your Monad instance's egress IP address

Confirm the allowlist update has been applied before running the connector.

## Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

### Settings

| Setting | Type | Required | Description |
| ------- | ---- | -------- | ----------- |
| Base URL | string | Yes | API base URL for your Abnormal Security tenant (e.g. `https://api.abnormalplatform.com`). Region-specific. |
| API Key | string (secret) | Yes | Abnormal Security REST API key from the portal integration tile. Sent as a Bearer token in the Authorization header. |
| Backfill Start Time | string | No | The date to start fetching data from (ISO 8601 format, e.g., `2024-01-15T00:00:00Z`). If not specified, no past records will be fetched. |

## Troubleshooting

### Common Issues

1. **Authentication Failures (401 Unauthorized)**
   - Verify the API key is correct and has not been revoked
   - Confirm the Monad egress IPs are on the Abnormal allowlist
   - Regenerate the API key if you suspect it may have been compromised

2. **Wrong Base URL (404 / connection errors)**
   - The base URL is region-specific — confirm it matches the value shown in the Abnormal portal under Settings → Integrations → REST API
   - Ensure you have not included `/v1` in the configured Base URL

3. **Missing Events**
   - Audit log events can take a short time to surface in the API after the action occurs — wait and re-run if necessary
   - Verify the Backfill Start Time isn't excluding events you expect to see

4. **Rate Limiting**
   - The connector enforces an internal request rate limit
   - If you encounter rate limit errors, check whether other processes are using the same API key

## Related Articles

- [Abnormal Security REST API Spec](https://app.swaggerhub.com/apis-docs/abnormal-security/abx)
- [Abnormal Security REST API Overview](https://abnormalsecurity.my.site.com/knowledgebase/s/article/Abnormal-REST-API-Integration)

## Sample Record

```json
{
  "category": "login",
  "action": "user_login",
  "status": "SUCCESS",
  "timestamp": "2024-11-14T12:00:00Z",
  "sourceIp": "203.0.113.42",
  "tenantName": "acme-corp",
  "user": {
    "email": "alice@acme.com"
  },
  "actionDetails": {
    "requestUrl": null,
    "messageId": null,
    "providedReason": null
  }
}
```

## Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See [Input Sync Frequency](../../guides/sync-frequency) for details.