Skip to content

Micro Focus ArcSight Logger via Logstash

Example overview

Webhooks can be used as system log sources. The number of log sources depends on the system complexity: the more components in the system, the greater number of log sources and logs. The most common logging scheme in complex systems consists of the following components:

  • Log collector: accepts logs from several sources and forwards logs to the SIEM system

  • SIEM system: used to analyze logs and monitor the system status

In the provided example, events are sent via webhooks to the Logstash log collector and forwarded to the ArcSight Logger system.

Webhook flow

Integration with the Enterprise version of ArcSight ESM

To configure forwarding logs from Logstash to the Enterprise version of ArcSight ESM, it is recommended to configure the Syslog Connector on the ArcSight side and then forward logs from Logstash to the connector port. A more detailed description of the connectors is available in the official Micro Focus documentation.

Used resources

ArcSight Logger configuration

ArcSight Logger has logs receiver Wallarm Logstash logs configured as follows:

  • Logs are received via UDP (Type = UDP Receiver)

  • Listening port is 514

  • Events are parsed with the syslog parser

  • Other default settings

Configuration of receiver in ArcSight Logger

A more detailed description of the receiver configuration is available in the official Micro Focus documentation.

Logstash configuration

Logstash is configured in the logstash-sample.conf file:

  • Incoming webhook processing is configured in the input section:

    • All HTTP and HTTPS traffic is sent to 5044 Logstash port
    • SSL certificate for HTTPS connection is located within the file /etc/pki/ca.pem
  • Forwarding logs to ArcSight Logger and log output are configured in the output section:

    • All event logs are forwarded from Logstash to ArcSight Logger at the IP address https://192.168.1.73:514
    • Logs are forwarded from Logstash to ArcSight Logger in the JSON format according to the Syslog standard
    • Connection with ArcSight Logger is established via UDP
    • Logstash logs are additionally printed on the command line (15 code line). The setting is used to verify that events are logged via Logstash
input {
  http { # input plugin for HTTP and HTTPS traffic
    port => 5044 # port for incoming requests
    ssl => true # HTTPS traffic processing
    ssl_certificate => "/etc/pki/ca.pem" # certificate for HTTPS connection
  }
}
output {
  syslog { # output plugin to forward logs from Logstash via Syslog
    host => "192.168.1.73" # IP address to forward logs to
    port => "514" # port to forward logs to
    protocol => "udp" # connection protocol
    codec => json # format of forwarded logs
  }
  stdout {} # output plugin to print Logstash logs on the command line
}

A more detailed description of the configuration files is available in the official Logstash documentation.

Testing Logstash configuration

To check that Logstash logs are created and forwarded to ArcSight Logger, the POST request can be sent to Logstash.

Request example:

curl -X POST 'https://192.168.1.65:5044' -H "Content-Type: application/json" -d '{"key1":"value1", "key2":"value2"}'

Logstash logs:

Logstash logs

Event in ArcSight Logger:

ArcSight Logger event

Configuration of webhook integration

  • Webhooks are sent to https://192.168.1.65:5044

  • Webhooks are sent via POST requests

  • Additional authentication parameter X-Auth-Token is passed in the request

  • Webhooks sent to Webhook URLs are all available events: hits, system events, vulnerabilities, scope changes

Webhook integration with Logstash

Example testing

To test the configuration, a new user is added in Wallarm Console:

Adding user

Logstash will log the event as follows:

Log about new user in ArcSight Logger from Logstash

The following entry will be displayed in ArcSight Logger events:

New user card in ArcSight Logger from Logstash