Miro app for Splunk – Miro Help Center

The Miro app for Splunk enables access to Miro audit logs from Splunk, facilitating centralized monitoring, timely alerting, and robust data visualization capabilities. By leveraging this setup, you gain a comprehensive overview and deeper insights into Miro’s audit logs, including information on user activity and security events, which helps streamline the monitoring and analysis processes. This not only simplifies log management but also enhances the decision-making process with more informed data-driven insights.

Available for: Enterprise plan
Set up by: Company Admins

Miro Configuration

Generate access token

1. In your Miro Enterprise settings page, go to Account > Enterprise Integrations.
The Enterprise integrations page appears.

Figure 1: Enterprise Integrations settings page

2. Click to turn on the SIEM toggle.

Once you enable the toggle, you can copy the access token or generate a new one.

Figure 2: Access Token for SIEM

⚠️ The integration is tied to the team with the largest number of users. It's not possible to choose a different team here but do note that the integration works for all the teams in your Enterprise plan and the integration-relevant events are shown for the whole plan in your Audit logs.

If another Admin enabled the toggle, you cannot copy the access token. However, you can still deactivate the integration.

Figure 3: Message that appears if the toggle is already enabled

Splunk configuration

Install Miro app

1. From your Splunk dashboard, navigate to Manage Apps by clicking the settings/manage apps icon (Figure 4).

Figure 4: Settings/Manage Apps icon

2. On the Apps page, click Browse more apps.

Figure 5: Browse more apps button

3. Search for Miro App for Splunk, and then proceed with the installation by clicking Install.

Figure 6: Installing Miro app for Splunk

4. Enter your credentials, click the check box to agree with the terms and conditions, and then click Login and Install.

Figure 7: Login and install

5. After the app is installed, you might be required to restart Splunk. Click Restart now.

Configure Miro app

Once the Miro app is installed, you can see it on the Splunk dashboard. To configure the app, click Miro App for Splunk (Figure 8).

Figure 8: Miro app for Splunk

Navigate to Configuration > Logging > Log level and set the Log level to INFO (Figure 9).

Figure 2: Log Level

From version 3.0.0, you can also configure a proxy for the Miro Splunk app by navigating to Configuration > Proxy.

Figure 10: Setting up a proxy

Create a new Input for your connector by navigating to the Inputs tab and clicking Create New Input.

Creating new input

Enter a representative Name for your new Input, define the Interval you want Splunk to fetch data from Miro (we recommend every 60 seconds), add the Access token you copied from the Miro app, and then click Add:

Figure 11: Add Miro Audit Logs

Ensure that the Input is Enabled. From this moment onwards Splunk starts receiving audit logs from Miro.

Figure 12: Checking the status

How to use Search

If you’re interested in which events are being sent to Splunk or you want to check the logs you can go to the Search tab:

For Audit logs events, you can filter by source="miro_audit_logs" and you will see a list of audit logs that were fetched from Miro in the specified time slot:

Figure 13: Miro Audit logs in Splunk

For Logs, you can filter by index="_internal" sourcetype="miroappforsplunk:log" and you will see the list of logs in the specified time slot for the Miro app:

Figure 14: Miro Logs in Splunk

Data visualization

The Miro Splunk app can be enriched with two predefined data visualizations that show an overview of your data insights. You can create dashboards by pasting the XML code provided below for the visualizations in your own Splunk setup, by following these steps:

Click the Visualize your data section on the Splunk Admin homepage.

Figure 15: Visualize your data
Click Create New Dashboard and fill in the details as you see fit.

Figure 16: Create New Dashboard

Figure 17: Create New Dashboard

On the new dashboard view, click on Source and paste the XML code.

Click to view the User Activity visualizations XML code.

<dashboard theme="light" version="1.1">
<label>Miro User Activity</label>
<description>Overview of user events in your Miro account.</description>
<search id="basesearch">
<query>source=miro_audit_logs | fields * | eval context.team.name = if(isnull('context.team'), 'context.team.name', "None") | search context.organization.name = "$form.organization$" context.team.name = "$form.team$"</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="time">
<label>Time range</label>
<default>
<earliest>-30d@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="organization">
<label>Organization</label>
<fieldForLabel>context.organization.name</fieldForLabel>
<fieldForValue>context.organization.name</fieldForValue>
<search base="basesearch">
<query>| table context.organization.name | dedup context.organization.name</query>
</search>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="team">
<label>Team</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>context.team.name</fieldForLabel>
<fieldForValue>context.team.name</fieldForValue>
<search base="basesearch">
<query>| table context.team.name | dedup context.team.name</query>
</search>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Total events</title>
<search base="basesearch">
<query>| stats count</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
<row>
<panel>
<chart>
<title>Events by date</title>
<search base="basesearch">
<query>| timechart count as Events</query>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.chart">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
<panel>
<chart>
<title>Events by team</title>
<search base="basesearch">
<query>| rename context.team.name as Team | stats count as "Events" by Team | sort - "Events"</query>
</search>
<option name="charting.chart">pie</option>
<option name="charting.chart.sliceCollapsingThreshold">0.03</option>
<option name="charting.drilldown">all</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="form.team">$click.value$</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel>
<single>
<title>Board events</title>
<search base="basesearch">
<query>| search event = board_* | stats count</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
<panel>
<single>
<title>Boards created</title>
<search base="basesearch">
<query>| search event = board_created | stats count</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
<panel>
<single>
<title>Boards opened</title>
<search base="basesearch">
<query>| search event = board_opened | stats count</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
<row>
<panel>
<chart>
<title>Boards opened or created</title>
<search base="basesearch">
<query>| search event = board_created OR event = board_opened | timechart count as "Boards created" by event</query>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</dashboard>

Click to view the Security Activity visualizations XML code.

<dashboard theme="light" version="1.1">
<label>Miro Security Activity</label>
<description>Overview of security events in your Miro account.</description>
<search id="basesearch">
<query>source=miro_audit_logs | fields * | search context.organization.name = "$form.organization$"</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="time">
<label>Time range</label>
<default>
<earliest>-30d@d</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="organization">
<label>Organization</label>
<fieldForLabel>context.organization.name</fieldForLabel>
<fieldForValue>context.organization.name</fieldForValue>
<search base="basesearch">
<query>| table context.organization.name | dedup context.organization.name</query>
</search>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="team">
<label>Team</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>context.team.name</fieldForLabel>
<fieldForValue>context.team.name</fieldForValue>
<search base="basesearch">
<query>| table context.team.name | dedup context.team.name</query>
</search>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Successful sign-ins</title>
<search base="basesearch">
<query>| search event = sign_in_succeeded | stats count</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
<panel>
<single>
<title>Failed sign-ins</title>
<search base="basesearch">
<query>| search event = sign_in_failed | stats count</query>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
<row>
<panel>
<chart>
<title>Sign-ins by authentication method</title>
<search base="basesearch">
<query>| search event = sign_in_* | timechart count as Events by details.authType</query>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<title>Sharing events</title>
<search base="basesearch">
<query>| search event = *public_link* OR event = *sharing* | rename context.team.name as Team createdBy.name as User object.name as Board details.role as Details event as Event | table id _time Event Team User Board Details</query>
</search>
<option name="count">10</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<table>
<title>File events</title>
<search base="basesearch">
<query>| search event = board_exported OR event = file_* | rename context.team.name as Team createdBy.name as User object.name as Board details.type as Type details.object as Object event as Event | table id _time Event Team User Board Type Object</query>
</search>
<option name="count">10</option>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard>

Figure 18: Edit dashboard

User Activity

The first visualization is User Activity, where you can find an overview of your user’s events in Miro. These are:

The number of events over time, by team and total.
Board Events: boards created, boards opened and total.

Figure 19: User activity