Initialize the OpenAI Beat

Prerequisites

• System Monitor version 7.26 or higher is installed.

• JSON Parsing is enabled. For more information, refer to Configure Beats for JSON Parsing.

• The following port is open:

Initialize the Beat via the Web Console (Recommended)

1. Ensure that the Open Collector Connection to the SIEM (WebUI) setup has been completed.

2. Ensure that the System Monitor Agent to which you intend to send these logs has been Configured for JSON Parsing.

3. Follow the steps outlined in Add a Beat in the Web Console to create the Beat via the Web UI.

Initialize the Beat via Command Line (Legacy)

1. In the Open Collector, run the following command:

   ./lrctl openaibeat start
   

2. Enter a unique Beat identifier (name).

3. Enter the hostname of your OpenAI Enterprise instance.
   For example, https://api.openai.com is pre-populated by default.

4. Enter the Personal Access Token (Secret Key) obtained during the steps outlined in Configure OpenAI.

5. Enter audit_logs as the log type to fetch.

6. Enter the number of days of historical data to fetch, between 1 and 7 days.
   The default value is 7 days.

7. Enter the number of audit log events to fetch per request, between 1 and 1000.
   The default value is 100.

8. Enter the polling interval, which is the time period between subsequent calls.
   The default value is 60 seconds.

9. Enter the hostname or IP address of the System Monitor Agent that has been Configured for JSON Parsing, and then press Enter.

10. Enter the port on which the System Monitor Agent is configured to listen for JSON data (the default is 5044), and then press Enter.
    The openaibeat service started message appears.

11. Check the status of the service to confirm that it’s running:

    ./lrctl openaibeat status
    

12. (Optional) Edit the ChatGPT Beat configuration to update the values set above if needed.
    Ensure that you have all the needed information for each step available as you will need to re-enter it:

    ./lrctl openaibeat config edit