# Micro Focus ArcSight Logger via Fluentd
These instructions provide you with the example integration of Wallarm with the Fluentd data collector to further forward events to the ArcSight Logger system.
The most common logging scheme in complex systems consists of the following components:
* Data collector: accepts logs from several sources and forwards logs to the SIEM system
* [SIEM system](https://www.wallarm.com/what/siem-whats-security-information-and-event-management-technology-part-1) or log management systems: used to analyze logs and monitor the system status
!!! info "Integration with the Enterprise version of ArcSight ESM"
To configure forwarding logs from Fluentd to the Enterprise version of ArcSight ESM, it is recommended to configure the Syslog Connector on the ArcSight side and then forward logs from Fluentd to the connector port. To get a more detailed description of the connectors, please download the **SmartConnector User Guide** from the [official ArcSight SmartConnector documentation](https://community.microfocus.com/t5/ArcSight-Connectors/ct-p/ConnectorsDocs).
## Used resources
* [ArcSight Logger 7.1](#arcsight-logger-configuration) with the WEB URL `https://192.168.1.73:443` installed on CentOS 7.8
* [Fluentd](#fluentd-configuration) installed on Debian 11.x (bullseye) and available on `https://fluentd-example-domain.com`
* Administrator access to Wallarm Console in [EU cloud](https://my.wallarm.com) to [configure the Fluentd integration](#configuration-of-fluentd-integration)
!!! info "Wallarm Cloud IP addresses"
To provide Wallarm Cloud access to your system, you may need a list of its public IP addresses:
**US Cloud:**
```
34.102.90.100
34.94.156.115
35.235.115.105
34.94.85.217
34.94.51.234
34.102.59.122
34.94.238.72
35.235.100.79
34.102.45.38
34.94.241.21
34.94.203.193
34.94.238.221
34.94.9.235
34.94.118.150
34.94.193.9
```
**EU Cloud:**
```
34.141.230.156
34.91.138.113
34.90.114.134
35.204.127.78
34.90.24.155
34.7.147.149
```
**ME Cloud:**
```
34.166.215.174
```
Since the links to the ArcSight Logger and Fluentd services are cited as examples, they do not respond.
### ArcSight Logger configuration
ArcSight Logger has logs receiver `Wallarm Fluentd logs` configured as follows:
* Logs are received via UDP (`Type = UDP Receiver`)
* Listening port is `514`
* Events are parsed with the syslog parser
* Other default settings
To get a more detailed description of the receiver configuration, please download the **Logger Installation Guide** of an appropriate version from the [official ArcSight Logger documentation](https://community.microfocus.com/t5/Logger-Documentation/ct-p/LoggerDoc).
### Fluentd configuration
Since Wallarm sends logs to the Fluentd intermediate data collector via webhooks, the Fluentd configuration should meet the following requirements:
* Accept the POST or PUT requests
* Accept HTTPS requests
* Have public URL
* Forward logs to ArcSight Logger, this example uses the `remote_syslog` plugin to forward logs
Fluentd is configured in the `td-agent.conf` file:
* Incoming webhook processing is configured in the `source` directive:
* Traffic is sent to port 9880
* Fluentd is configured to accept only HTTPS connections
* Fluentd TLS certificate signed by a publicly trusted CA is located within the file `/etc/ssl/certs/fluentd.crt`
* Private key for TLS certificate is located within the file `/etc/ssl/private/fluentd.key`
* Forwarding logs to ArcSight Logger and log output are configured in the `match` directive:
* All event logs are copied from Fluentd and forwarded to ArcSight Logger at the IP address `https://192.168.1.73:514`
* Logs are forwarded from Fluentd to ArcSight Logger in the JSON format according to the [Syslog](https://en.wikipedia.org/wiki/Syslog) standard
* Connection with ArcSight Logger is established via UDP
* Fluentd logs are additionally printed on the command line in JSON format (19-22 code lines). The setting is used to verify that events are logged via Fluentd
```bash linenums="1"
@type http # input plugin for HTTP and HTTPS traffic
port 9880 # port for incoming requests
# configuration for connections handling
cert_path /etc/ssl/certs/fluentd.crt
private_key_path /etc/ssl/private/fluentd.key
@type copy
@type remote_syslog # output plugin to forward logs from Fluentd via Syslog
host 192.168.1.73 # IP address to forward logs to
port 514 # port to forward logs to
protocol udp # connection protocol
@type json # format of forwarded logs
@type stdout # output plugin to print Fluentd logs on the command line
output_type json # format of logs printed on the command line
```
A more detailed description of configuration files is available in the [official Fluentd documentation](https://docs.fluentd.org/configuration/config-file).
!!! info "Testing Fluentd configuration"
To check that Fluentd logs are created and forwarded to ArcSight Logger, the PUT or POST request can be sent to Fluentd.
**Request example:**
```curl
curl -X POST 'https://fluentd-example-domain.com' -H "Content-Type: application/json" -d '{"key1":"value1", "key2":"value2"}'
```
**Fluentd logs:**
**Event in ArcSight Logger:**
### Configuration of Fluentd integration
* Webhooks are sent to `https://fluentd-example-domain.com`
* Webhooks are sent via POST requests
* The webhook integration has default advanced settings
* Webhooks sent to Webhook URLs are all available events: hits, system events, vulnerabilities, scope changes
[More details on the Fluentd integration configuration](https://docs.wallarm.com/user-guides/settings/integrations/fluentd.md)
## Example testing
To test the configuration, a new user is added in Wallarm Console:
Fluentd will log the event as follows:
The following entry will be displayed in ArcSight Logger events:
