Dean Flaming

Tech Curmudgeons

Dean Flaming

These are my technical notes and blog postings on Identity, Mobility, and More...

Using a Python Script to Grab Audit Data from Workspace ONE Access

Introduction:

For organizations who wish to capture audit data from their VMware Workspace ONE Access tenant(s) without having to manually export the admin audit data manually, 10K lines at a time, the below Python script will allow you to export that data via an authenticated API and store it locally on your own system. The export can be executed manually or automatically and can be set to pull a specified time range or constantly listen and pull live data.

Credits:

Huge thanks to Assaf Abramovich, Michael Almond, Kamlesh Patil, and Balaine Wightman for developing this.


Download:

Download audit_server_v2.zip from EverNote. If you are prompted for a login, please cancel/close that tab and right-click on the audit_server_v2.zip file link and open it in a new tab or Window. If you are still prompted for login or if you wish to see this blog posting on EverNote directly, please go here.


Instructions:

Here are the instructions for getting this up and running. It is highly recommended to test this on a NON-PRODUCTION environment first in order to ensure it works as expected and has no negative impacts (it shouldn't as it is only pulling data via a bearer token, but I never suggest testing in production as that is bad form).

  1. Install python v3.7.4 or higher onto a workstation
  2. Install ‘pip install requests’ & ‘pip install tabulate’
    1. On macos this is done from Terminal and may require running "pip3" instead of "pip"
    2. In Windows, this is done from command prompt with "pip" command.
  3. Create a new Remote App Access ‘audit-service’ within the Workspace ONE Access tenant as Admin.
    1. Login to Workspace ONE Access tenant as tenant Super Admin and create the Service Client Bearer Token and copy the Client ID and Shared Secret to be used in the config.ini file.
      1. Under Catalog (menu), select Settings, then select Remote App Settings and ensure CLIENT is selected in the main page
      2. Click CREATE CLIENT
        1. Access Type: Service Client Token
        2. Client ID:
          1. Example: "audit-service" (no quotes)
        3. Expand ADVANCED
          1. Generate Shared Secret
          2. Token Type: Bearer
        4. Click ADD
  4. Download the ZIP file above in the "Download" section
  5. Copy and paste both ‘audit_api_runner.py’ & ‘config.ini’ to a directory (e.g. ‘\Scripts’)
  6. Edit the ‘config.ini’ file to include the client ID & client secret
  7. Run the script (On Windows, all commands should be executed from the ‘\Scripts’ working directory - On Mac, commands can be launched from within IDLE via
    1. Run the following command to continuously pull data as a live stream
      "\Scripts>audit_api_runner.py -d -f 1 -p "
      1. The above will run continuously streaming the output to an "output" folder
    2. Run the following command from the working directory (command prompt as Administrator) to pull historical data
      "\Scripts>audit_api_runner.py -f 100 -o logs -i "
    3. The CONFIG file may need to be manually specified if python does not automatically find it in the same folder (even if it is in the same folder) Using the "-c" command line option allows for specifying the full path to the config.ini file
      "\Scripts>audit_api_runner.py -c "" -f 100 -o logs -i "" "
    4. Command line options for specifying various options may be found by running the 'audit_api_runner.py' command without any switches.
      1. NOTE: This is also a good way to see if Python correctly sees the "requests" and "tabulate" modules as these MUST be installed prior to running and obtaining audit data
      2. The "-d" option is for debugging
      3. The "-p" option is for continuous polling. Default is 1 second
      4. When pulling historical data, "-f" is still needed and frequency interval should be increased from default for lighter loads to pull historical data as needed
  8. The script will create a directory called ‘audit-data’ from the working directory
"\Scripts\audit-data"

Notes:

This audit-data export is in the form of a CSV which can then be opened externally in Excel or some other spreadsheet or database tool.

Published by Dean Flaming on