Which API to use for Jira Service Desk audit log capture using Splunk?

[Joe Resler]

Hello, I am trying to capture audit logs from Jira Service Desk by calling the API - however I don't get any results. 

curl --request GET \
  --url 'https://api.atlassian.com/admin/v1/orgs/{orgId}/events' \
  --header 'Authorization: Bearer ' \
  --header 'Accept: application/json'

 I am trying to use the following documentation: https://developer.atlassian.com/cloud/admin/organization/rest/#api-orgs-orgId-events-get

I would like to use the Spunk add-on to call an API and gather all the audit logs. Which Splunk add-on should I use and which API should I call? 

One other thing I noticed, there are 2 audit log collections (atlassian Cloud Platform audit logs and Jira Service Desk audit logs). I'd like to capture both. How can I accomplish this using Splunk add-ons and what API's to call. Can someone help? 

[Andy Heinzer · Accepted solution]

Hi Joe,

The documentation you cited does explain how you can get organization data out of the Atlassian Cloud REST API, but I think there is some confusion here over the term 'organizations'.  The ones references in that guide are not specific to Jira Service Desk.  Instead these organizations are used to manage all the users and groups across the Atlassian Cloud products (Jira Software, Confluence, etc).

However Jira Service Desk has it's own organizations that are intended to help Jira Admins and Service Desk Agents manage their customer base that use Service Desk to raise requests.  More details on accessing that organization data via REST in https://developer.atlassian.com/cloud/jira/service-desk/rest/#api-rest-servicedeskapi-organization-get.

However that data isn't audit log data for those Service Desk organizations. There are some Audit log endpoints for Jira Core you can access in GET /rest/api/3/auditing/record.  But I am not sure if this is what you are looking for exactly. There are more details about what data is available in the Jira Cloud audit logs in Audit logging.

I fear that if you're looking for an audit log endpoint specifically for Service Desk, I don't believe this is information that our REST APIs are going to be able to provide at this time.

Does this help?

Andy

[Joe Resler]

Thanks Adny for your help, with a few keywords you had I was able to finish my research. Very much appreciated!