Scrape Onboardbase Activity Logs

Requirements:

A Linux server
Onboardbase account( Follow this to get an API Key )

Installation

Pre-Requisites

Install requests package from pip globally

pip install requests

git clone https://github.com/Onboardbase/activity-log-collector.git onboardbase-activity-log-collector
cd onboardbase-activity-log-collector
Sets up cron to pull data from Onboardbase every 3 minutes
bash ./setup.sh [ONBOARDBASE_API_KEY] [ONBOARDBASE_PROJECT_NAME]

The setup collects logs at /var/onboardbase/logs/remote_activity.log.

The logs for the last run can be viewed here: /var/onboardbase/logs/cron.log.

Confirm the activity-log file is populated.

tail -f /var/onboardbase/logs/remote_activity.log

Staying updated

Please maintain the repo anywhere it is being set up. Bug and improvements would be pushed directly to it.

You only need to go to the directory where this repo is and run:

git pull

Since the script runs via a cron job, the changes would be picked automatically on the next run.

Usage with Wazuh SIEM

Set up your wazuh-agent or wazuh-server to collect logs from the /var/onboardbase/logs/remote_activity.log file.

Wazuh Documentation - Monitoring Basic Logfiles

<ossec_config>
  <localfile>
    <log_format>syslog</log_format>
    <location>/var/onboardbase/logs/remote_activity.log</location>
  </localfile>
</ossec_config>