Micro Focus ArcSight Logger via Fluentd¶
These instructions provide you with the example integration of Wallarm with the Fluentd log collector to further forward events to the ArcSight Logger system.
Webhooks can be used as system log sources. The number of log sources depends on the system complexity: the more components in the system, the greater number of log sources and logs. The most common logging scheme in complex systems consists of the following components:
-
Log collector: accepts logs from several sources and forwards logs to the SIEM system
-
SIEM system: used to analyze logs and monitor the system status
Integration with the Enterprise version of ArcSight ESM
To configure forwarding logs from Fluentd to the Enterprise version of ArcSight ESM, it is recommended to configure the Syslog Connector on the ArcSight side and then forward logs from Fluentd to the connector port. To get a more detailed description of the connectors, please download the SmartConnector User Guide from the official ArcSight SmartConnector documentation.
Used resources¶
-
ArcSight Logger 7.1 with the WEB URL
https://192.168.1.73:443
installed on CentOS 7.8 -
Fluentd installed on Debian 10.4 (Buster) and available on
https://192.168.1.65:9880
-
Administrator access to Wallarm Console in EU cloud to configure the webhook integration
Wallarm Cloud IP addresses
To provide Wallarm Cloud access to your system, you may need a list of its public IP addresses. To get these addresses, request them from the Wallarm technical support team.
Note that the public IP addresses of Wallarm Cloud can change from time to time. If your experience some problems with the addresses that you currently use, request up-to-date addresses from the Wallarm technical support team.
Since the links to the ArcSight Logger and Fluentd services are cited as examples, they do not respond.
ArcSight Logger configuration¶
ArcSight Logger has logs receiver Wallarm Fluentd logs
configured as follows:
-
Logs are received via UDP (
Type = UDP Receiver
) -
Listening port is
514
-
Events are parsed with the syslog parser
-
Other default settings
To get a more detailed description of the receiver configuration, please download the Logger Installation Guide of an appropriate version from the official ArcSight Logger documentation.
Fluentd configuration¶
Fluentd is configured in the td-agent.conf
file:
-
Incoming webhook processing is configured in the
source
directive:- Traffic is sent to port 9880
- Fluentd is configured to accept only HTTPS connections
- Fluentd TLS certificate signed by a publicly trusted CA is located within the file
/etc/ssl/certs/fluentd.crt
- Private key for TLS certificate is located within the file
/etc/ssl/private/fluentd.key
-
Forwarding logs to ArcSight Logger and log output are configured in the
match
directive:- All event logs are copied from Fluentd and forwarded to ArcSight Logger at the IP address
https://192.168.1.73:514
- Logs are forwarded from Fluentd to ArcSight Logger in the JSON format according to the Syslog standard
- Connection with ArcSight Logger is established via UDP
- Fluentd logs are additionally printed on the command line in JSON format (19-22 code lines). The setting is used to verify that events are logged via Fluentd
- All event logs are copied from Fluentd and forwarded to ArcSight Logger at the IP address
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
|
A more detailed description of configuration files is available in the official Fluentd documentation.
Testing Fluentd configuration
To check that Fluentd logs are created and forwarded to ArcSight Logger, the PUT or POST request can be sent to Fluentd.
Request example:
curl -X POST 'https://192.168.1.65:9880' -H "Content-Type: application/json" -d '{"key1":"value1", "key2":"value2"}'
Fluentd logs:
Event in ArcSight Logger:
Configuration of webhook integration¶
-
Webhooks are sent to
https://192.168.1.65:9880
-
Webhooks are sent via POST requests
-
The webhook integration has default advanced settings
-
Webhooks sent to Webhook URLs are all available events: hits, system events, vulnerabilities, scope changes
More details on the webhook integration configuration
Example testing¶
To test the configuration, a new user is added in Wallarm Console:
Fluentd will log the event as follows:
The following entry will be displayed in ArcSight Logger events: