Configure the system for the Security Audit 3.0 module

Starting with system version 2026.4, use the Security Audit 3.0 module. When enabled, a microservice will be automatically deployed in the Kubernetes environment using the portable service configured in the module. This microservice is responsible for logging events to the database and transmitting them to the system interface for display in the Security Audit widget.

начало внимание

To get the installation module file, please contact your BRIX sales rep.

конец внимание

Before installing and setting up the module, configure it to connect to the PostgreSQL database where the logged events will be stored. To do this:

  1. Prepare the connection string to the PostgreSQL database.
  2. Configure a secure connection between the module and the database.

If a secure connection is used on the PostgreSQL side, configure the module's connection to the audit database using SSL.

Important: if your company previously used security audit and you have updated the system to version 2026.4 or higher, use the instructions for updating the module to the latest version 3.0.

Step 1: Prepare a PostgreSQL database connection string

Data collected in the system and displayed using the Security Audit module is stored in a PostgreSQL database. Install the uuid-ossp and pg_trgm extensions in this database. Also, consider the disk storage capacity based on the information processed in your company. For more information on configuring PostgreSQL and installing the uuid-ossp and pg_trgm extensions, see the Databases section.

Information from the module is stored in a database separate from system data. When you first connect the module to the database, all the tables required for operation will be created. By default, the database name for the Security Audit module is audit.

To connect the module to the database, prepare a PostgreSQL connection string for read and write operations in the format: postgresql://user:password@hostname:port/databaseName?sslmode=disable, where:

  • user is the name of the PostgreSQL user with permissions to the databaseName database.
  • password is the password for the PostgreSQL user.
  • hostname is the IP or domain name of the PostgreSQL server.
  • port is the port for connecting to PostgreSQL (the default port is 5432).
  • databaseName is the name of the database (the default name is audit).
  • sslmode is the use of a secure connection.

Step 2: Connect the module to the security audit database

  1. To ensure a secure connection to the audit database, create a Kubernetes secret with the connection string to it in the namespace of the portable services. By default, this is brix365-applets. To do this, run the command:

 

kubectl create secret generic audit-db-connections \
 --namespace="brix365-applets" \
 --from-literal=PSQL_URL="db" \
 --dry-run=client -o yaml | kubectl apply -f -

Where:

  • brix365-applets is the namespace of the portable services.
  • db is the audit database connection string prepared earlier.
  1. Verify that ConfigMap usage is enabled for the portable services.
  2. Pass the previously created Kubernetes secret to the portable service to connect it to the audit database. To do this, set the following parameters in the ConfigMap by running the command:

kubectl apply -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: "brix365-applets"
  name: brix365-babysitter-config
data:
  head.ext_3d37e007-ce67-4672-9fd9-1f477e9e4fe4.audit: |
    secretMappings:
      - secretRef: "audit-db-connections"
        type: "env"
EOF

Where:

  • brix365-applets is the namespace of the portable services.
  • head.ext_3d37e007-ce67-4672-9fd9-1f477e9e4fe4.audit is the name of the configuration block. It includes the security audit module ID and the name of the portable service. Leave this name unchanged and in this block specify the name of the Kubernetes secret, as well as how it will be transferred.
  • audit-db-connections is the name of the Kubernetes secret that contains the connection string to the audit database.

After configuring the connection to the audit database, install the Security Audit 3.0 module.

Configure the module's connection to the audit database using SSL (optional)

If you have configured required traffic encryption and certificate verification on the PostgreSQL database side, perform the following steps:

  1. Create a secret with existing client certificates for the module:

kubectl create secret generic postgresql-client-ssl-secret  --from-file=root.crt=root.crt   --from-file=tls.crt=client.crt --from-file=tls.key=client.key   --type=kubernetes.io/tls

  1. Create a database connection string for the module:

postgres://user:pgpassword@audit-pg/audit?sslmode=verify-full&sslrootcert=/etc/certs/root.crt&sslcert=/etc/certs/tls.crt&sslkey=/etc/certs/tls.key

Where:

  • user is the PostgreSQL user name that must be specified in the client certificate (CN).
  • pgpassword is the database connection password.
  • audit-pg is the address of the security audit database.
  • audit is the name of the security audit database.
  • sslrootcert is the path to the root certificate.
  • sslcert is the path to the client certificate.
  • sslkey is path to the file with the client certificate's private key.
  1. Create a secret to connect the module to the database:

kubectl create secret generic audit-db-connections \
  --namespace="brix365-applets" \
  --from-literal=PSQL_URL="db" \
  --dry-run=client -o yaml | kubectl apply -f -

Where:

  • brix365-applets is namespace of the portable services.
  • db is the connection string to the audit database.
  1. Verify that ConfigMap is enabled for the portable services.
  2. Pass the previously created Kubernetes secret to the module’s portable service to connect it to the audit database. To do this, set the following parameters in the ConfigMap by running the command:

kubectl apply -f - << EOF
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: "brix365-applets"
  name: brix365-babysitter-config
data:
  head.ext_3d37e007-ce67-4672-9fd9-1f477e9e4fe4.audit: |
    secretMappings:
      - secretRef: "audit-db-connections"
        type: "env"
      - secretRef: "postgresql-client-ssl-secret"
        type: "volume"
        mountPath: "/etc/certs"
EOF

Where:

  • brix365-applets is the namespace of the portable services.
  • head.ext_3d37e007-ce67-4672-9fd9-1f477e9e4fe4.audit is the name of the configuration block. It includes the security audit module ID and the name of the portable service. Leave this name unchanged and in this block specify the name of the Kubernetes secret and how it is transferred.
  • audit-db-connections is the name of the Kubernetes secret that contains the connection string to the audit database.

 

After configuring the connection to the audit database, install the Security Audit 3.0 module.

 

audit_service.html update-audit.html