Merge pull request #4606 from ministryofjustice/update-audit-log-from…

…-modsec

docs: ✏️ update instructions to get modsec logs

runbooks/source/get-audit-log-from-modsec.html.md.erb

@@ -1,15 +1,19 @@
 ---
 title: Get an audit log from modsec
 weight: 8600
-last_reviewed_on: 2023-03-16
+last_reviewed_on: 2023-05-19
 review_in: 3 months
 ---
 
-# Get an audit log from modsec
+# Opensearch modsec setup
+
+We have introduced an opensearch dashboard which collects all modsec logs and has document level security enabled. This means users can only access the logs for the github team they are in (see here for more details)[https://user-guide.cloud-platform.service.justice.gov.uk/documentation/networking/modsecurity.html]. With this feature in place users can self serve and access their own modsec logs. In the case of a rare error, we may shut off logs to the dashboard (from fluent-bit) and then you must use the instructions below to access modsec logs on behalf of the user.
+
+## Get an audit log from modsec (when fluent-bit is not pushing to opensearch)
 
 On occasion users may need you to provide them with audit log information on an modsec event from our ingress-controllers. This information may be sensitive so it can't be placed in our org-wide Elasticsearch cluster. You'll need to fetch this information from the pod that generated the log.
 
-## How do I check the audit log
+### How do I check the audit log
 
 As mentioned above, the audit log cannot be placed into Elasticsearch so you'll need the following:
 
@@ -32,7 +36,7 @@ example: https://mojdt.slack.com/archives/C57UPMZLY/p1630936971082200
 
 - Kubectl access to the live cluster and access to the `ingress-controllers` namespace.
 
-## Perform a search for the unique-id (obtained from the Kibana entry)
+### Perform a search for the unique-id (obtained from the Kibana entry)
 
 ```
 # assuming the event id is 16494071776.005464