Collect Atlassian Confluence logs

Supported in:

This document explains how to ingest Atlassian Confluence logs to Google Security Operations. The parser first attempts to extract fields from the raw log message using regular expressions (grok patterns) designed for Atlassian Confluence logs. If the grok parsing fails or the log is in JSON format, the code then attempts to parse the message as JSON. Finally, the extracted fields are mapped to the Google SecOps UDM schema and enriched with additional context.

Before you begin

Make sure you have the following prerequisites:

  • A Google SecOps instance
  • Atlassian Confluence Cloud account with audit log access OR Confluence Data Center/Server with administrative access
  • For AWS-based methods: Privileged access to AWS (S3, IAM, Lambda, EventBridge)
  • For Bindplane method: Windows 2016 or later or Linux host with systemd

Integration options overview

This guide provides two integration paths:

  • Option 1: Confluence Data Center/Server via BindPlane + Syslog
  • Option 2: Confluence Cloud Audit Logs via AWS Lambda + S3 (JSON format)

Choose the option that best fits your Confluence deployment type and infrastructure.

Option 1: Confluence Data Center/Server via Bindplane + Syslog

This option configures Confluence Data Center or Server to send logs via syslog to a Bindplane agent, which then forwards them to Google SecOps.

Get Google SecOps ingestion authentication file

  1. Sign in to the Google SecOps console.
  2. Go to SIEM Settings > Collection Agents.
  3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

Get Google SecOps customer ID

  1. Sign in to the Google SecOps console.
  2. Go to SIEM Settings > Profile.
  3. Copy and save the Customer ID from the Organization Details section.

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

  1. Open the Command Prompt or PowerShell as an administrator.

  2. Run the following command:

    msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet

Linux installation

  1. Open a terminal with root or sudo privileges.

  2. Run the following command:

    sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh

Additional installation resources

Configure the Bindplane agent to ingest Syslog and send to Google SecOps

  1. Access the configuration file:

    1. Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
    2. Open the file using a text editor (for example, nano, vi, or Notepad).

  2. Edit the config.yaml file as follows:

    receivers:
  udplog:
    # Replace the port and IP address as required
    listen_address: "0.0.0.0:514"

exporters:
  chronicle/chronicle_w_labels:
    compression: gzip
    # Adjust the path to the credentials file you downloaded
    creds_file_path: '/path/to/ingestion-authentication-file.json'
    # Replace with your actual customer ID
    customer_id: YOUR_CUSTOMER_ID
    endpoint: malachiteingestion-pa.googleapis.com
    log_type: 'ATLASSIAN_CONFLUENCE'
    raw_log_field: body
    ingestion_labels:

service:
  pipelines:
    logs/confluence:
      receivers:
        - udplog
      exporters:
        - chronicle/chronicle_w_labels
    • Replace the port and IP address as required in your infrastructure.
    • Replace <YOUR_CUSTOMER_ID_HERE> with the actual customer ID.
    • Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

Restart the Bindplane agent to apply the changes

  • To restart the Bindplane agent in Linux, run the following command:

    sudo systemctl restart bindplane-agent

  • To restart the Bindplane agent in Windows, you can either use the Services console or enter the following command:

    net stop BindPlaneAgent && net start BindPlaneAgent

Configure Syslog forwarding on Confluence Data Center/Server

  1. Sign in to your Confluence server via SSH or RDP.
  2. Locate the Log4j configuration file:
    • For Log4j2: <confluence-install>/confluence/WEB-INF/classes/log4j2.xml

  3. Edit the configuration file to add a SyslogAppender:

    <Configuration>
  <Appenders>
    <!-- Existing appenders -->

    <Syslog name="SyslogAppender" 
            host="BINDPLANE_AGENT_IP" 
            port="514" 
            protocol="UDP"
            facility="LOCAL0"
            format="RFC5424">
      <PatternLayout pattern="%d{ISO8601} %p [%t] [%c{1}] %m%n"/>
    </Syslog>
  </Appenders>

  <Loggers>
    <Root level="info">
      <AppenderRef ref="SyslogAppender"/>
      <!-- Other appender refs -->
    </Root>

    <!-- Audit logger -->
    <Logger name="com.atlassian.confluence.event.events.security.AuditEvent" level="info" additivity="false">
      <AppenderRef ref="SyslogAppender"/>
    </Logger>
  </Loggers>
</Configuration>
    • Replace BINDPLANE_AGENT_IP with the IP address of your BindPlane agent.

  4. Restart Confluence to apply changes:

    sudo systemctl restart confluence

Option B: Configure rsyslog to forward local log files

  1. Configure Confluence to write logs to files (default behavior).

  2. Install rsyslog if not present:

    sudo apt-get install rsyslog  # Debian/Ubuntu
sudo yum install rsyslog      # RHEL/CentOS

  3. Create rsyslog configuration file /etc/rsyslog.d/confluence.conf:

    # Forward Confluence logs to BindPlane
$ModLoad imfile

# Application logs
$InputFileName /opt/atlassian/confluence/logs/atlassian-confluence.log
$InputFileTag confluence-app:
$InputFileStateFile stat-confluence-app
$InputFileSeverity info
$InputFileFacility local0
$InputRunFileMonitor

# Audit logs (JSON format in DC/Server)
$InputFileName /var/atlassian/application-data/confluence/log/audit/*.json
$InputFileTag confluence-audit:
$InputFileStateFile stat-confluence-audit
$InputFileSeverity info
$InputFileFacility local1
$InputRunFileMonitor

# Forward to BindPlane agent
*.* @@BINDPLANE_AGENT_IP:514
    • Replace BINDPLANE_AGENT_IP with the IP address of your Bindplane agent.
    • Adjust log file paths based on your Confluence installation:
      • Application logs typically: <confluence-install>/logs/ or <local-home>/logs/
      • Audit logs: <confluence-home>/log/audit/*.json

  4. Restart rsyslog:

    sudo systemctl restart rsyslog

Option 2: Confluence Cloud Audit Logs via AWS Lambda + S3

Collect Confluence Cloud API credentials

  1. Sign in to your Atlassian account.
  2. Go to https://id.atlassian.com/manage-profile/security/api-tokens.
  3. Click Create API token.
  4. Enter a label for the token (for example, Google Security Operations Integration).
  5. Click Create.
  6. Copy and save the API token securely.
  7. Note your Confluence Cloud site URL (for example, https://yoursite.atlassian.net).
  8. Note your Atlassian account email address (used for authentication).

Configure AWS S3 bucket and IAM for Google SecOps

  1. Create Amazon S3 bucket following this user guide: Creating a bucket
  2. Save bucket Name and Region for future reference (for example, confluence-audit-logs).
  3. Create a User following this user guide: Creating an IAM user.
  4. Select the created User.
  5. Select Security credentials tab.
  6. Click Create Access Key in section Access Keys.
  7. Select Third-party service as Use case.
  8. Click Next.
  9. Optional: Add a description tag.
  10. Click Create access key.
  11. Click Download CSV file to save the Access Key and Secret Access Key for future reference.
  12. Click Done.
  13. Select Permissions tab.
  14. Click Add permissions in section Permissions policies.
  15. Select Add permissions.
  16. Select Attach policies directly.
  17. Search for AmazonS3FullAccess policy.
  18. Select the policy.
  19. Click Next.
  20. Click Add permissions.

Configure the IAM policy and role for S3 uploads

  1. In the AWS console, go to IAM > Policies > Create policy > JSON tab.

  2. Enter the following policy: 

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPutObjects",
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::confluence-audit-logs/*"
    },
    {
      "Sid": "AllowGetStateObject",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::confluence-audit-logs/confluence-audit/state.json"
    }
  ]
}
    • Replace confluence-audit-logs if you entered a different bucket name.

  3. Click Next > Create policy.

  4. Name the policy ConfluenceAuditToS3Policy.

  5. Go to IAM > Roles > Create role > AWS service > Lambda.

  6. Attach the newly created policy ConfluenceAuditToS3Policy.

  7. Name the role ConfluenceAuditLambdaRole and click Create role.

Create the Lambda function

  1. In the AWS Console, go to Lambda > Functions.
  2. Click Create function > Author from scratch.

  3. Provide the following configuration details:

    Setting Value
    Name ConfluenceAuditToS3
    Runtime Python 3.13
    Architecture x86_64
    Execution role ConfluenceAuditLambdaRole

  4. After the function is created, open the Code tab, delete the stub and enter the following the code:

    import json
import os
import boto3
from datetime import datetime, timezone, timedelta
from urllib import request, parse, error
from base64 import b64encode

# Environment variables
S3_BUCKET = os.environ['S3_BUCKET']
S3_PREFIX = os.environ.get('S3_PREFIX', 'confluence-audit/')
STATE_KEY = os.environ.get('STATE_KEY', 'confluence-audit/state.json')
CONFLUENCE_URL = os.environ['CONFLUENCE_URL']  # e.g., https://yoursite.atlassian.net
CONFLUENCE_EMAIL = os.environ['CONFLUENCE_EMAIL']
CONFLUENCE_API_TOKEN = os.environ['CONFLUENCE_API_TOKEN']
MAX_RECORDS = int(os.environ.get('MAX_RECORDS', '1000'))

s3_client = boto3.client('s3')

def lambda_handler(event, context):
    """Fetch Confluence Cloud audit logs and write to S3."""

    # Read last execution state
    start_date = get_last_execution_time()
    end_date = datetime.now(timezone.utc)

    print(f"Fetching audit logs from {start_date} to {end_date}")

    # Fetch audit records
    records = fetch_audit_logs(start_date, end_date)

    if not records:
        print("No new audit records found.")
        save_state(end_date)
        return {'statusCode': 200, 'body': 'No new records'}

    # Write to S3
    timestamp = end_date.strftime('%Y%m%d_%H%M%S')
    object_key = f"{S3_PREFIX}audit_{timestamp}.json"

    s3_client.put_object(
        Bucket=S3_BUCKET,
        Key=object_key,
        Body='\n'.join(json.dumps(record) for record in records),
        ContentType='application/json'
    )

    print(f"Wrote {len(records)} records to s3://{S3_BUCKET}/{object_key}")

    # Update state
    save_state(end_date)

    return {
        'statusCode': 200,
        'body': f"Processed {len(records)} records"
    }

def get_last_execution_time():
    """Retrieve the last execution timestamp from S3 state file."""
    try:
        response = s3_client.get_object(Bucket=S3_BUCKET, Key=STATE_KEY)
        state = json.loads(response['Body'].read())
        return datetime.fromisoformat(state['last_execution'])
    except s3_client.exceptions.NoSuchKey:
        # First run: fetch logs from last 24 hours
        return datetime.now(timezone.utc) - timedelta(hours=24)
    except Exception as e:
        print(f"Error reading state: {e}")
        return datetime.now(timezone.utc) - timedelta(hours=24)

def save_state(execution_time):
    """Save the execution timestamp to S3 state file."""
    state = {'last_execution': execution_time.isoformat()}
    s3_client.put_object(
        Bucket=S3_BUCKET,
        Key=STATE_KEY,
        Body=json.dumps(state),
        ContentType='application/json'
    )

def fetch_audit_logs(start_date, end_date):
    """Fetch audit logs from Confluence Cloud REST API."""
    records = []
    start_param = int(start_date.timestamp() * 1000)  # milliseconds
    end_param = int(end_date.timestamp() * 1000)

    # Build authentication header
    auth_string = f"{CONFLUENCE_EMAIL}:{CONFLUENCE_API_TOKEN}"
    auth_bytes = auth_string.encode('ascii')
    auth_b64 = b64encode(auth_bytes).decode('ascii')

    headers = {
        'Authorization': f'Basic {auth_b64}',
        'Accept': 'application/json'
    }

    # Confluence Cloud Audit API endpoint
    url = f"{CONFLUENCE_URL}/wiki/rest/api/audit?startDate={start_param}&endDate={end_param}&limit=1000"

    try:
        req = request.Request(url, headers=headers)
        with request.urlopen(req) as response:
            data = json.loads(response.read())
            records = data.get('results', [])
            print(f"Retrieved {len(records)} audit records")
    except error.HTTPError as e:
        print(f"HTTP Error: {e.code} - {e.reason}")
        print(e.read().decode())
    except Exception as e:
        print(f"Error fetching audit logs: {e}")

    return records[:MAX_RECORDS]

  5. Go to Configuration > Environment variables.

  6. Click Edit > Add new environment variable.

  7. Enter the following environment variables, replacing with your values.

    Key Example value
    S3_BUCKET confluence-audit-logs
    S3_PREFIX confluence-audit/
    STATE_KEY confluence-audit/state.json
    CONFLUENCE_URL https://yoursite.atlassian.net
    CONFLUENCE_EMAIL your-email@example.com
    CONFLUENCE_API_TOKEN your-api-token-here
    MAX_RECORDS 1000

  8. Select the Configuration tab.

  9. In the General configuration panel click Edit.

  10. Change Timeout to 5 minutes (300 seconds) and click Save.

Create an EventBridge schedule

  1. Go to Amazon EventBridge > Scheduler > Create schedule.
  2. Provide the following configuration details:
    • Recurring schedule: Rate (1 hour).
    • Target: Your Lambda function ConfluenceAuditToS3.
    • Name: ConfluenceAuditToS3-1h.
  3. Click Create schedule.

Optional: Create read-only IAM user & keys for Google SecOps

  1. Go to AWS Console > IAM > Users.
  2. Click Add users.
  3. Provide the following configuration details:
    • User: Enter secops-confluence-reader.
    • Access type: Select Access key – Programmatic access.
  4. Click Next.
  5. Click Attach policies directly > Create policy.

  6. In the JSON editor, enter the following policy:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::confluence-audit-logs/*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": "arn:aws:s3:::confluence-audit-logs"
    }
  ]
}

  7. Set the name to secops-reader-policy.

  8. Go to Create policy > search/select > Next > Add permissions.

  9. Go to Security credentials > Access keys > Create access key.

  10. Download the CSV (these values are entered into the feed).

Configure a feed in Google SecOps to ingest Confluence logs

  1. Go to SIEM Settings > Feeds.
  2. Click Add New Feed.
  3. In the Feed name field, enter a name for the feed (for example, Confluence Cloud Audit Logs).
  4. Select Amazon S3 V2 as the Source type.
  5. Select Atlassian Confluence as the Log type.
  6. Click Next.
  7. Specify values for the following input parameters:
    • S3 URI: s3://confluence-audit-logs/confluence-audit/
    • Source deletion options: Select deletion option according to your preference.
    • Maximum File Age: Include files modified in the last number of days. Default is 180 days.
    • Access Key ID: User access key with access to the S3 bucket.
    • Secret Access Key: User secret key with access to the S3 bucket.
    • Asset namespace: The asset namespace.
    • Ingestion labels: The label applied to the events from this feed.
  8. Click Next.
  9. Review your new feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Log Field UDM Mapping Logic
agent read_only_udm.network.http.user_agent Value taken from "agent" field.
app_protocol read_only_udm.network.application_protocol Derived from "app_protocol" field. If "app_protocol" contains "HTTPS", "HTTP", "SSH", or "RDP", the corresponding protocol is used. Otherwise, it defaults to "UNKNOWN_APPLICATION_PROTOCOL".
app_protocol read_only_udm.network.application_protocol_version Value taken from "app_protocol" field.
auditType.action read_only_udm.security_result.action Derived from "auditType.action" field. If "auditType.action" contains "successful", the value is set to "ALLOW". If it contains "restricted", the value is set to "BLOCK".
auditType.action read_only_udm.security_result.summary Value taken from "auditType.action" field when "auditType" is not empty and "auditType_area" is "SECURITY".
auditType.actionI18nKey read_only_udm.metadata.product_event_type Value taken from "auditType.actionI18nKey" field when "auditType" is not empty.
auditType.area read_only_udm.security_result.detection_fields.value Value taken from "auditType.area" field and assigned to the "value" field of a detection field with the "key" field set to "auditType area". This mapping is done when "auditType" is not empty.
auditType.category read_only_udm.security_result.category_details Value taken from "auditType.category" field when "auditType" is not empty.
auditType.categoryI18nKey read_only_udm.security_result.detection_fields.value Value taken from "auditType.categoryI18nKey" field and assigned to the "value" field of a detection field with the "key" field set to "auditType categoryI18nKey". This mapping is done when "auditType" is not empty.
auditType.level read_only_udm.security_result.detection_fields.value Value taken from "auditType.level" field and assigned to the "value" field of a detection field with the "key" field set to "auditType level". This mapping is done when "auditType" is not empty.
author.displayName read_only_udm.principal.user.user_display_name Value taken from "author.displayName" field.
author.externalCollaborator read_only_udm.security_result.about.resource.attribute.labels.value Value taken from "author.externalCollaborator" field and assigned to the "value" field of a label with the "key" field set to "externalCollaborator".
author.id read_only_udm.principal.user.userid Value taken from "author.id" field when "author.type" is "user" and "principal_user_present" is "false".
author.isExternalCollaborator read_only_udm.security_result.about.resource.attribute.labels.value Value taken from "author.isExternalCollaborator" field and assigned to the "value" field of a label with the "key" field set to "isExternalCollaborator".
author.name read_only_udm.principal.user.user_display_name Value taken from "author.name" field when "author.type" is "user" and "principal_user_present" is "false".
bytes_in read_only_udm.network.received_bytes Value taken from "bytes_in" field if it contains digits. Otherwise, it defaults to 0.
category read_only_udm.security_result.category_details Value taken from "category" field.
changedValues read_only_udm.principal.resource.attribute.labels Iterates through each element in "changedValues" and creates labels with keys like "changedValue[index][key]" and values from the corresponding values in the "changedValues" array.
creationDate read_only_udm.metadata.event_timestamp Value taken from "creationDate" field, parsed as either UNIX or UNIX_MS timestamp.
extraAttributes read_only_udm.principal.resource.attribute.labels Iterates through each element in "extraAttributes" and creates labels with keys based on "name" and "nameI18nKey" fields and values from the corresponding "value" field.
http_verb read_only_udm.network.http.method Value taken from "http_verb" field.
ip read_only_udm.target.ip Value taken from "ip" field.
principal_host read_only_udm.principal.hostname Value taken from "principal_host" field.
referral_url read_only_udm.network.http.referral_url Value taken from "referral_url" field.
remoteAddress read_only_udm.principal.ip Value taken from "remoteAddress" field, parsed as an IP address.
response_code read_only_udm.network.http.response_code Value taken from "response_code" field.
session_duration read_only_udm.additional.fields.value.string_value Value taken from "session_duration" field and assigned to the "string_value" field of a label with the "key" field set to "Session Duration".
source read_only_udm.principal.ip Value taken from "source" field, parsed as an IP address.
src_ip read_only_udm.principal.ip Value taken from "src_ip" field if "remoteAddress" is empty.
summary read_only_udm.security_result.summary Value taken from "summary" field.
sysAdmin read_only_udm.security_result.about.resource.attribute.labels.value Value taken from "sysAdmin" field and assigned to the "value" field of a label with the "key" field set to "sysAdmin".
superAdmin read_only_udm.security_result.about.resource.attribute.labels.value Value taken from "superAdmin" field and assigned to the "value" field of a label with the "key" field set to "superAdmin".
target_url read_only_udm.target.url Value taken from "target_url" field.
timestamp read_only_udm.metadata.event_timestamp Value taken from "timestamp" field, parsed as a date and time string.
user_id read_only_udm.principal.user.userid Value taken from "user_id" field.
read_only_udm.metadata.event_type This field's value is determined by a series of checks and defaults to "GENERIC_EVENT". It is set to specific values like "NETWORK_HTTP", "USER_UNCATEGORIZED", or "STATUS_UPDATE" based on the presence and content of other fields like "principal_host", "user_id", "has_principal", and "author.type".
read_only_udm.metadata.vendor_name Set to "ATLASSIAN".
read_only_udm.metadata.product_name Set to "CONFLUENCE".
read_only_udm.metadata.log_type Set to "ATLASSIAN_CONFLUENCE".
read_only_udm.principal.user.user_display_name This field's value can come from either "author.displayName" or "affectedObject.name" depending on the context.
read_only_udm.target.process.pid This field's value can come from either "principal_host" or "pid" depending on the context.
read_only_udm.principal.resource.attribute.labels This field is populated with various labels derived from fields like "affectedObjects", "changedValues", and "extraAttributes". The keys and values of these labels are dynamically generated based on the specific content of these fields.

Need more help? Get answers from Community members and Google SecOps professionals.