# SIEM Log Pull
Cloudbrink's Log Pull feature enables the ability to continuously send logs from the Cloudbrink Admin Portal, into customer hosted SIEM log servers.
Cloudbrink provides customers with centralized visibility and management control. Customers can define all their policies from a single cloud-based management console. Similarly, customers can view all the data about their users, endpoints and apps from the single console even though users are accessing all types of apps – SaaS, public/private cloud hosted apps and on-prem datacentre hosted apps.
This guide outlines the process for configuring the Log Pull feature to effectively send logs to your preferred SIEM Log Server.
#### Introduction
This document will walkthrough how to configure logs from the Cloudbrink admin portal to be sent to a customers SIEM log server.
#### Prerequisites
Cloudbrink admin portal access
SIEM server deployed
Scripting API client to authenticate, then retrieve log messages
#### SIEM Log Pull Config
1. When logging into the Cloudbrink Admin Portal, navigate to > Configure > System > Log Collectors > New Log Collector.
2. Add a new Log Collector by providing a name to the log collector entity, setting TYPE to “Private Hosted” by default, and click "Generate new api-token"
3. Create a client side script to call the log-retrieve API using the above token. Any scripting language that can call RESTful API's may be utilized.
4. Get an access token from the API-Token. Note, each {customer-ORG-code} is unique. If you are unsure what the ORG code is, reach out to .
curl --request GET \\
\--url ' access-token?valid\_mins=60' \ --header 'Content-Type: application/json' \ --header 'x-cb-api-refresh: BQE6qfEUr9/
5. The response to the above request will contain the access-token in the response body
"BgGm/dWRFAfv43iPUfJGzaH8QhtLAFR9SKPbe32qGvtXKS1doDkyWVr3uUCVxEBfafprfO44v5kYhBZjaPYWs2JEvOICC8KKeLgbX/upMy9psvvwFb2PdNkwl5yB9qhQ3sjJseam1bW0fDpifMd8jpOrf4/TPKZLKkY9u/m7rvI5ejR4Icw+KEsO72hoV7TBBsPXAI1qDeU7rp8NgwunECxfSzCtc9vzmGVYV1gHxaKajRHDvVcBwwsQDF1yTOm2HWyAvuES69/ FzTEZYHLpBH17AR3jkxsjuKJJk1HYI6XdLSPn1YdBy4A/1uInRQeYwCIaJilYrAa06TwfguZYOQ9SBx4gCZho+vosHlBoDJVDFzlwzexcjMfal1f+NTRkPvxPOZh8hTilxm1Z0oFnOyKV5tkk105AzFUVKKqT5NZiFxkumCS6sPGrb9+X5ivZzBNtBgpsmvNNEmlmX7hFr4PYvVqfo+Br/u1wQOKXuFs+DoZdUQRjVkEf0mzcZgsR0XA3SzoPSyajCOy6RMc="
6. Retrieve log data using the above access token.
curl --request GET \\
\--url '' \\
\--header 'Authorization: BgGm/dWRFAfv43iPUfJGzaH8QhtLAFR9SKPbe32qGvtXKS1doDkyWVr3uUCVxEBfafprfO44v5kYhBZjaPYWs2JEvOICC8KKeLgbX/ upMy9psvvwFb2PdNkwl5yB9qhQ3sjJseam1bW0fDpifMd8jpOrf4/TPKZLKkY9u/ m7rvI5ejR4Icw+KEsO72hoV7TBBsPXAI1qDeU7rp8NgwunECxfSzCtc9vzmGVYV1gHxaKajRHDvVcBwwsQDF1yTOm2HWyAvuES69/FzTEZYHLpBH17AR3jkxsjuKJJk1HYI6XdLSPn1YdBy4A/1uInRQeYwCIaJilYrAa06TwfguZYOQ9SBx4gCZho+vosHlBoDJVDFzlwzexcjMfal1f+NTRkPvxPOZh8hTilxm1Z0oFnOyKV5tkk105AzFUVKKqT5NZiFxkumCS6sPGrb9+X5ivZzBNtBgpsmvNNEmlmX7hFr4PYvVqfo+Br/ u1wQOKXuFs+DoZdUQRjVkEf0mzcZgsR0XA3SzoPSyajCOy6RMc=' \\
\--header 'accept: application/json'
\
7\. The response body to the above request contains the log data from Cloudbrink
\[
{
"log\_level": "AUDIT",
"message": "Access Token validation successful",
"message\_timestamp": "2023-03-11T01:37:11.129Z"
},
{
"log\_level": "AUDIT",
"message": "Access Token validation successful",
"message\_timestamp": "2023-03-11T01:37:36.361Z"
}
]
8. When the access-token expires, the API-token can be used as per step-1 and get the new access-token. Repeat steps to regenerate the token.
9. Note: Customers can delete an existing API-token client from the management portal. Once deleted, any existing scripts using the API-client token will stop receiving the responses
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.cloudbrink.com/configuration/siem-log-pull.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.