Build and export Immuta reports

Immuta reports allow data governors to use a natural language builder to instantly create reports that detail user activity across Immuta.

1. Click select entity and choose the option you would like the report based on from the dropdown menu. Your options include User, Group, Project, Data Source, Purpose, Policy Type, Connection, or Tag.

2. After making your selection, type your entity name in the enter name field.

3. Select the name from the dropdown menu that appears. Once the entity name has been selected, a number of reports will populate the center window.

4. Click a tile with the description of the report to run that report. You may only see up to 100 rows of output in the UI when you run a report. To see the full results of your report, follow the step below to export to CSV.

5. Once you've run the report, you can click the Export to CSV button in the top right of the page to download the report.

If you would like to switch reports from this page, you can make changes by clicking the dropdown menu and then Refresh to run a new report. Otherwise, click Back to Report Builder in the top right of the page to return to the full report builder.

Create an ADLS shared access signature token for the export

Before Immuta can export audit events to your Azure Data Lake Storage (ADLS) Gen2 storage account, you need to create a shared access signature (SAS) token that allows the Immuta audit service to add audit logs to your specified ADLS storage account and file system.

Follow the Azure documentation to create the following in Azure:

1. An ADLS Gen2 storage account with the following settings required for audit export:

   • Enable hierarchical namespace

   • Standard performance is adequate, but premium may be used

2. A dedicated container.

3. A shared access signature (SAS) for your dedicated container with at least the following permissions at the storage account or container level:

   • Create

   • Write

Save the SAS token to use in the next steps. Do not navigate away from the SAS page unless you have saved the token.

Configure the audit export to ADLS

You can configure your audit export destination using one of two methods:

1. Immuta CLI

2. Immuta Audit Service GraphQL API

Using the Immuta CLI

Install the Immuta CLI

Download the binary in a tab below that corresponds to your operating system:

Configure the Immuta CLI

For descriptions of the commands used below, see the Immuta audit export configuration CLI reference guide.

1. The SHA 256 checksum is available to verify the file at https://immuta-platform-artifacts.s3.amazonaws.com/cli/latest/immuta_cli_SHA256SUMS.

2. Run immuta configure in your terminal.

3. Enter the URL of your Immuta tenant in the interactive prompt.

4. Enter your Immuta API Key.

Configure Immuta to export audit logs to ADLS

1. Set the following parameters in a JSON or YAML file:

   • interval: The interval at which audit logs will be exported to your ADLS storage. They can be sent at 2-, 4-, 6-, 12-, or 24-hour intervals.

   • storage account: The name of the storage account you created that your audit logs will be sent to.

   • file system: The name of the file system (or container) you created that your audit logs will be written to.

   • path: The name of the path in the file system. This will be a new folder or directory in the container where Immuta will send your audit logs for storage.

   • SAS token: The previously-generated SAS token.

   Copy

   {
   "interval": "EVERY_12_HOURS",
   "storageAccount": "your-adls-storage-account",
   "filesystem": "audit-output",
   "path": "immuta-audit",
   "sasToken": "your-sas-token"
   }

2. Create an export configuration in Immuta by running the following command:

   Copy

   immuta audit exportConfig create:adls ./your-exportConfig.json

List all configurations

To view all of the export configurations created for your Immuta tenant, run the following command:

immuta audit exportConfig list

View a configuration

To review a specific export configuration, run the get command with the export configuration ID as the argument:

immuta audit exportConfig get your-exportConfig-ID

Disable a configuration

To disable a configuration, run the following command with the export configuration ID as the argument:

immuta audit exportConfig disable your-exportConfig-ID

Enable a configuration

To enable a disabled configuration, run the following command with the export configuration ID as the argument:

immuta audit exportConfig enable your-exportConfig-ID

Delete a configuration

To delete an export configuration, run the following command with the export configuration ID as the argument:

immuta audit exportConfig delete your-exportConfig-ID

Using the audit service GraphQL API

Configure Immuta to export audit logs to ADLS Gen2

1. Pass the following fields into the $data variable used in the mutation in the next step:

   • interval: The interval at which audit logs will be exported to your ADLS storage. They can be sent at 2-, 4-, 6-, 12-, or 24-hour intervals.

   • storage account: The name of the storage account you created that your audit logs will be sent to.

   • file system: The name of the file system (or container) you created that your audit logs will be written to.

   • path: The name of the path in the file system. This will be a new folder or directory in the container where Immuta will send your audit logs for storage.

   • SAS token: The previously-generated SAS token.

   Copy

   {
   "interval": "EVERY_12_HOURS",
   "storageAccount": "your-adls-storage-account",
   "filesystem": "audit-output",
   "path": "immuta-audit",
   "sasToken": "your-sas-token"
   }

2. Configure these settings in Immuta using the createAdlsExportConfiguration mutation:

mutation createAdlsExportConfiguration($data: CreateAdlsExportConfigurationInput!) {
  createAdlsExportConfiguration(data: $data) {
    id
    enabled
    interval
    endpointConfiguration {
      ... on AdlsEndpointConfiguration {
        storageAccount
        filesystem
        path
      }
    }
  }
}

{"data": CreateAdlsExportConfigurationInput}

{
  "interval": "EVERY_2_HOURS",
  "storageAccount": "your-adls-storage-account",
  "filesystem": "audit-output",
  "path": "immuta-audit",
  "sasToken": "your-sas-token"
}

{
  "data": {
    "createADlsExportConfiguration": {
      "id": "4",
      "enabled": true,
      "interval": "EVERY_2_HOURS",
      "endpointConfiguration": {
        "storageAccount": "your-adls-storage-account",
        "filesystem": "audit-output",
        "path": "immuta-audit"
      }
    }
  }
}

Disable a configuration

To disable a configuration, use the disableExportConfiguration mutation:

mutation disableExportConfiguration($id: String!) {
  disableExportConfiguration(id: $id) {
    id
    interval
    enabled
  }
}

{"id": "4"}

{
  "data": {
    "disableExportConfiguration": {
      "id": "4",
      "interval": "EVERY_2_HOURS",
      "enabled": false
    }
  }
}

Enable a configuration

To enable a disabled configuration, use the enableExportConfiguration mutation:

mutation enableExportConfiguration($id: String!) {
  enableExportConfiguration(id: $id) {
    id
    interval
    enabled
  }
}

{"id": "4"}

{
  "data": {
    "enableExportConfiguration": {
      "id": "4",
      "interval": "EVERY_2_HOURS",
      "enabled": true
    }
  }
}

</div>

</div>

    ```

Create an S3 bucket policy for the export

Before Immuta can export audit events to your S3 bucket, you need to create a bucket policy that allows the Immuta audit service to add objects to your specified S3 bucket. The following Amazon S3 action will be granted to the audit service in the bucket policy:

• : Adds an object to a bucket.

To create the policy for the bucket, you must be the bucket owner.

1. Follow for adding a bucket policy in the Amazon S3 console. To create the policy for the bucket, you must be the bucket owner.

2. Edit the JSON in the Policy section to include a bucket policy like the example below. In this example, the policy allows immuta-audit-service (the ) to add objects to customer-bucket-name (and the contents within that bucket).

   Note: If you use this example, replace the content in angle brackets with your and bucket name.

3. Save your changes.

Configure the audit export to S3

You can configure your audit export destination using one of two methods:

Using the Immuta CLI

Install the Immuta CLI

Download the binary in a tab below that corresponds to your operating system:

Configure the Immuta CLI

2. Run immuta configure in your terminal.

3. Enter the URL of your Immuta tenant in the interactive prompt.

4. Enter your Immuta API Key.

Configure Immuta to export audit logs to S3

1. Set the following parameters in a JSON or YAML file:

   • interval: The interval at which audit logs will be exported to your S3 bucket. They can be sent at 2-, 4-, 6-, 12-, or 24-hour intervals.

   • bucket name: Name of the bucket your audit logs will be sent to.

   • bucket path: Path to your bucket in Amazon S3.

   • region: AWS region (such as "us-east-1").

   • accessKeyId: AWS access key ID.

   • secretAccessKey: AWS secret access key.
2. Configure these settings in Immuta by running the following command:

List all configurations

To view all of the export configurations created for your instance of Immuta, run the following command:

View a configuration

To review a specific export configuration, run the get command with the export configuration ID as the argument:

Disable a configuration

To disable a configuration, run the following command with the export configuration ID as the argument:

Enable a configuration

To enable a disabled configuration, run the following command with the export configuration ID as the argument:

Delete a configuration

To delete an export configuration, run the following command with the export configuration ID as the argument:

Using the audit service GraphQL API

Configure Immuta to export audit logs to S3

1. Pass the following fields into the $data variable used in the mutation in the next step:

   • interval: The interval at which audit logs will be exported to your S3 bucket. They can be sent at 2-, 4-, 6-, 12-, or 24-hour intervals.

   • bucket name: Name of the bucket your audit logs will be sent to.

   • bucket path: Path to your bucket in Amazon S3.

   • region: AWS region (such as "us-east-1").

   • accessKeyId: AWS access key ID.

   • secretAccessKey: AWS secret access key.
2. Configure these settings in Immuta using the createS3ExportConfiguration mutation:

Disable a configuration

To disable a configuration, use the disableExportConfiguration mutation:

Enable a configuration

To enable a disabled configuration, use the enableExportConfiguration mutation: