# Configure the system for the Security Audit 3.0 module

> [HTML Version](security-audit-3.html)

Starting with system version 2026.4, use the **Security Audit 3.0** module. When enabled, a microservice will be automatically deployed in the Kubernetes environment using the [portable service](portable-microservices.md) configured in the module. This microservice is responsible for logging events to the database and transmitting them to the system interface for display in the **Security Audit** widget.

````
начало внимание

````
To get the installation module file, please contact your BRIX sales rep.

````
конец внимание

````
Before installing and setting up the module, configure it to connect to the PostgreSQL database where the logged events will be stored. To do this:

1. [Prepare the connection string to the PostgreSQL database](#pg).

2. [Configure a secure connection between the module and the database](#connect-db).

If a secure connection is used on the PostgreSQL side, [configure the module's connection to the audit database using SSL](#ssl).

**Important**: if your company previously used security audit and you have updated the system to version 2026.4 or higher, use the instructions for updating the module to the latest version 3.0. 

## Step 1: Prepare a PostgreSQL database connection string

Data collected in the system and displayed using the **Security Audit** module is stored in a PostgreSQL database. Install the **uuid-ossp** and **pg\_trgm** extensions in this database. Also, consider the disk storage capacity based on the information processed in your company. For more information on configuring PostgreSQL and installing the **uuid-ossp** and **pg\_trgm** extensions, see the [Databases](postgresql.md) section.

Information from the module is stored in a database separate from system data. When you first connect the module to the database, all the tables required for operation will be created. By default, the database name for the **Security Audit** module is `audit`.

To connect the module to the database, prepare a PostgreSQL connection string for read and write operations in the format: `postgresql://user:password@hostname:port/databaseName?sslmode=disable`, where:

- `user` is the name of the PostgreSQL user with permissions to the `databaseName` database.

- `password` is the password for the PostgreSQL user.

- `hostname` is the IP or domain name of the PostgreSQL server.

- `port` is the port for connecting to PostgreSQL (the default port is 5432).

- `databaseName` is the name of the database (the default name is `audit`).

- `sslmode` is the use of a secure connection.

## Step 2: Connect the module to the security audit database

1. To ensure a secure connection to the audit database, create a Kubernetes secret with the connection string to it in the namespace of the portable services. By default, this is `brix365-applets`. To do this, run the command:



````
kubectl create secret generic audit-db-connections \\  
 --namespace="brix365-applets" \\  
 --from-literal=PSQL\_URL="db" \\  
 --dry-run=client -o yaml | kubectl apply -f -

````
Where:

- `brix365-applets` is the namespace of the portable services.

- `db` is the audit database connection string prepared earlier.

2. Verify that [ConfigMap usage is enabled](configmap.md#enable-configmap) for the portable services.

3. Pass the previously created Kubernetes secret to the portable service to connect it to the audit database. To do this, set the following parameters in the ConfigMap by running the command:

````
kubectl apply -f - << EOF  
apiVersion: v1  
kind: ConfigMap  
metadata:  
  namespace: "brix365-applets"  
  name: brix365-babysitter-config  
data:  
  head.ext\_3d37e007-ce67-4672-9fd9-1f477e9e4fe4.audit: |  
    secretMappings:  
      - secretRef: "audit-db-connections"  
        type: "env"  
EOF

````
Where:

- `brix365-applets` is the namespace of the portable services.

- `head.ext\_3d37e007-ce67-4672-9fd9-1f477e9e4fe4.audit` is the name of the configuration block. It includes the security audit module ID and the name of the portable service. Leave this name unchanged and in this block specify the name of the Kubernetes secret, as well as how it will be transferred.

- `audit-db-connections` is the name of the Kubernetes secret that contains the connection string to the audit database.

After configuring the connection to the audit database, [install the Security Audit 3.0 module](audit-module-settings.md).

## Configure the module's connection to the audit database using SSL (optional)

If you have configured required traffic encryption and certificate verification on the PostgreSQL database side, perform the following steps:

1. Create a secret with existing client certificates for the module:

````
kubectl create secret generic postgresql-client-ssl-secret  --from-file=root.crt=root.crt   --from-file=tls.crt=client.crt --from-file=tls.key=client.key   --type=kubernetes.io/tls

2. ````
Create a database connection string for the module:

````
postgres://user:pgpassword@audit-pg/audit?sslmode=verify-full\&sslrootcert=/etc/certs/root.crt\&sslcert=/etc/certs/tls.crt\&sslkey=/etc/certs/tls.key

````
Where:

- `user` is the PostgreSQL user name that must be specified in the client certificate (CN).

- `pgpassword` is the database connection password.

- `audit-pg` is the address of the security audit database.

- `audit` is the name of the security audit database.

- `sslrootcert` is the path to the root certificate.

- `sslcert` is the path to the client certificate.

- `sslkey` is path to the file with the client certificate's private key.

3. Create a secret to connect the module to the database:

````
kubectl create secret generic audit-db-connections \\  
  --namespace="brix365-applets" \\  
  --from-literal=PSQL\_URL="db" \\  
  --dry-run=client -o yaml | kubectl apply -f -

````
Where:

- `brix365-applets` is namespace of the portable services.

- `db` is the connection string to the audit database.

4. Verify that [ConfigMap is enabled](configmap.md#enable-configmap) for the portable services.

5. Pass the previously created Kubernetes secret to the module’s portable service to connect it to the audit database. To do this, set the following parameters in the ConfigMap by running the command:

````
kubectl apply -f - << EOF  
apiVersion: v1  
kind: ConfigMap  
metadata:  
  namespace: "brix365-applets"  
  name: brix365-babysitter-config  
data:  
  head.ext\_3d37e007-ce67-4672-9fd9-1f477e9e4fe4.audit: |  
    secretMappings:  
      - secretRef: "audit-db-connections"  
        type: "env"  
      - secretRef: "postgresql-client-ssl-secret"  
        type: "volume"  
        mountPath: "/etc/certs"  
EOF

````
Where:

- `brix365-applets` is the namespace of the portable services.

- `head.ext\_3d37e007-ce67-4672-9fd9-1f477e9e4fe4.audit` is the name of the configuration block. It includes the security audit module ID and the name of the portable service. Leave this name unchanged and in this block specify the name of the Kubernetes secret and how it is transferred.

- `audit-db-connections` is the name of the Kubernetes secret that contains the connection string to the audit database.



After configuring the connection to the audit database, [install the Security Audit 3.0 module](audit-module-settings.md).