Juniper Networks Security Threat Response Manager User Guide

Enable or disable a log source. See

•

Grouping Log Sources

•

Defining Log Source Parsing Order

Configuring STRM to Receive Events

STRM automatically discovers many log sources in your deployment that are sending syslog messages. Any log sources that are automatically discovered by

STRM appear in the Log Sources window. You can configure automatically discovered log sources on a per Event Collector basis using the Autodetection

Enabled parameter in the Event Collector configuration. For more information, see the STRM Administration Guide, Using the Deployment Editor.

NOTE

For more information about auto discovered log sources, see the Configuring

DSMs Guide.

Log Source Users Guide

ANAGING

OURCES

Step 1

To configure STRM to receive events from devices:

Configure the external Device Support Module (DSM) to send events to STRM.

Step 2

For information on configuring DSMs, see the Configuring DSMs Guide and your vendor documentation.

Configure log sources in STRM to receive events from the DSMs. See

Managing

Log Sources

NOTE

You must have administrative privileges to configure log sources in STRM. For more information on accessing the Admin tab, see the STRM Administration

Guide.

Managing Log

Sources

A log source provides events to your deployment through DSMs. Using the Admin tab, you can:

•

View log sources. See

Viewing Log Sources

•

Add a log source. See

Adding a Log Source

• Edit an existing log source. See

Editing a Log Source

•

Enabling/Disabling a Log Source

•

Delete a log source. See

Deleting a Log Source

•

Add a bulk log source. See

Adding Multiple Log Sources

•

Edit a bulk log source. See

Editing Multiple Log Sources

Viewing Log Sources

To view existing log sources, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Sources icon.

The Log Sources window is displayed.

If a log source has not received any events within the configured syslog timeout period, the Status column displays Error. If you manually configure a log source that uses syslog, the Status column displays a status of Error until that log source has received an event. For more information about the Syslog Event Timeout parameter, see the STRM Administration Guide.

NOTE

Bulk added log sources display N/A in the Status column.

Log Source Users Guide

Managing Log Sources

Adding a Log Source

To add a log source to your deployment, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

The Data Sources pane is displayed.

Step 3

Click the Log Sources icon.

Step 4

The Log Sources window is displayed.

Click Add.

The Add a log source window is displayed.

Step 5

Type values for the following parameters:

Table 1-1 Add a Log Source Parameters

Parameter

Log Source Name

Log Source Description

Log Source Type

Protocol Configuration

Enabled

Credibility

Target Event Collector

Description

Type the desired name of the log source. The name can be up to 255 characters in length.

Type a description for the log source (optional).

From the drop-down list, select the type of log source to add.

From the drop-down list box, select the protocol configuration for the log source. The Protocol

Configuration allows you to define protocol parameters for communication with the log source, such as JDBC, syslog, SNMP, or vendor specific protocols. The available protocols displayed in the Protocol

Configuration drop-down list box are based on the Log

Source Type selected.

For information about specific protocols and parameters, see

Select this check box to enable the log source. By default, the check box is selected.

From the drop-down list box, select the credibility of the log source. The range is 0 to 10. The credibility indicates the integrity of an event or offense as determined by the credibility rating from the source devices. Credibility increases if multiple sources report the same event. The default is 5.

From the drop-down list box, select the Event Collector to use as the target for the log source.

Log Source Users Guide

ANAGING

OURCES

Table 1-1 Add a Log Source Parameters (continued)

Parameter

Coalescing Events

Store Event Payload

Log Source Extension

Description

Select this check box to enable the log source to coalesce (bundle) events. By default, the check box is selected.

Autodetected log sources use the default value configured in the Coalescing Events parameter in the

STRM Settings window. However, when you create a new log source or update the configuration for an autodetected log source, the value configured in the individual log source is the value used by the log source. For more information, see the

STRM

Administration Guide.

Select this check box to enable or disable the log source to store event payload information. By default, the check box is selected.

Autodetected log sources use the value configured in the Store Event Payload parameter in the STRM

Settings window. However, when you create a new log source or update the configuration for an autodetected log source, the value configured in the individual log source is the value used by the log source. For more information, see the STRM Administration Guide.

The Log Source Extension parameter only appears if you have a log source extension configured in your deployment. Log source extensions allow you to immediately extend the parsing routines of specific log sources, which ensures DSMs send valid data to

STRM. For more information on log source extensions, see

From the drop-down list box, select the log source extension to use for this log source.

Log Source Users Guide

Managing Log Sources

Table 1-1 Add a Log Source Parameters (continued)

Parameter

Extension Use Condition

Groups

Description

The Extension Use Condition parameter only appears if you have a log source extension configured in your deployment. For more information on log source

extensions, see

From the drop-down list box, select the Extension Use

Condition to apply to this log source:

•

Parsing Enhancement - When the DSM is unable to parse correctly and the event is categorized as

stored, the selected log source extension extends the failing parsing by creating a new event as if the new event came from the DSM. This is the default setting.

Parsing Override - When a DSM parses correctly for most fields but needs one or more fields added or modified, the fields specified in the log source extension are overwritten. We recommend that you enable the Parsing Override parameter for Universal

DSMs.

Select one or more groups for the log source.

Step 6

Click Save.

Step 7

The Log Sources window is displayed.

On the Admin tab, click Deploy Changes.

Editing a Log Source

To edit a log source, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

The Data Sources pane is displayed.

Step 3

Click the Log Sources icon.

Step 4

The Log Sources window is displayed.

Select the log source to edit.

NOTE

To edit the log source name, log source description, log source identifier, or group of a log source, double-click the log source.

Step 5

Click Edit.

The Edit a log source window is displayed.

Step 6

Edit values for the parameters, as necessary:

Log Source Users Guide

ANAGING

OURCES

Table 1-2 Edit a Log Source Parameters

Parameter

Log Source Name

Log Source Description

Log Source Type

Protocol Configuration

Enabled

Credibility

Target Event Collector

Coalescing Events

Store Event Payload

Description

Type the desired name of the log source. The name can be up to 255 characters in length.

Type a description for the log source (optional).

From the drop-down list, select the type of log source to add.

From the drop-down list, select the protocol to use for this log source. Only the protocols that are available for the selected Log Source Type appear in the list.

The required configuration parameters appear. For more information about protocol parameters, see

Select this check box to enable the log source. By default, the check box is selected.

From the drop-down list box, select the Event Collector to use as the target for the log source.

Select this check box to enable the log source to coalesce (bundle) events. By default, the check box is selected.

Autodetected log sources use the default value configured in the Coalescing Events parameter in the

Administration Guide.

Enables or disables the ability for a log source to store event payload information. By default, the check box is selected.

Autodetected log sources use the default value configured in the Store Event Payload parameter in the

Administration Guide.

Log Source Users Guide

Managing Log Sources

Table 1-2 Edit a Log Source Parameters (continued)

Parameter

Log Source Extension

Extension Use Condition

Groups

Description

STRM. For more information on log source extensions, see

From the drop-down list box, select the log source extension to use for this log source.

The Extension Use Condition parameter only appears if you have a log source extension configured in your deployment. For more information on log source

extensions, see

From the drop-down list box, select a use condition to apply to this log source:

•

Parsing Enhancement - When the DSM is unable to parse correctly and the event is categorized as

stored, the selected log source extension extends the failed parsing by creating a new event as if the new event came from the DSM. This is the default setting.

DSMs.

Select one or more groups for the log source.

Step 7

Click Save.

The Log Sources window is displayed.

Enabling/Disabling a

Log Source

To enable or disable a log source, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

The Data Sources pane is displayed.

Step 3

Click the Log Sources icon.

Step 4

The Log Sources window is displayed.

Select the log source that you want to enable or disable.

Step 5

Click Enable/Disable.

When a log source is enabled, the Enabled column indicates true. When a log source is disabled, the Status column indicates Disabled.

Log Source Users Guide

ANAGING

OURCES

NOTE

If you cannot enable a log source, you might have exceeded your license restrictions. For more information about your license limits, see the Managing the

System Chapter of the STRM Administration Guide. If you require additional license limits, contact your sales representative.

Deleting a Log

Source

To delete a log source. perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Sources icon.

Step 4

The Log Sources window is displayed.

Select the log source you want to delete.

Step 5

Click Delete.

Step 6

A confirmation window is displayed.

Click OK.

NOTE

You can delete multiple log sources by holding the Shift key to select multiple log sources and click Delete.

Adding Multiple Log

Sources

You can add multiple log sources to STRM that share a configuration protocol. Log sources allow you to bulk add and configure hosts by uploading a text file, using a domain query, or typing a host name or IP address. A maximum of 500 active hosts or IP addresses can share a single protocol configuration. If you attempt to add more than 500 hosts, an error message is displayed.

Step 1

To add multiple log sources to your deployment, perform the following steps:

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Sources icon.

The Log Sources window is displayed.

Step 4

Using the Bulk Actions drop-down menu, select Bulk Add.

Step 5

The Add a bulk log source window is displayed.

Type values for the parameters, as necessary:

Log Source Users Guide

Managing Log Sources

Table 1-3 Adding a Bulk Log Source Parameters

Parameter

Bulk Log Source Name

Log Source Type

Protocol Configuration

Enabled

Credibility

Target Event Collector

Coalescing Events

Store Event Payload

Description

Type the desired name for the group or bulk log source.

The name can be up to 255 characters in length.

Note: Adding a bulk log source automatically creates a log source group using the name you input into this field.

From the drop-down list, select the type of log source to add.

From the drop-down list, select the protocol to use for this log source. Only the protocols that are available for the selected Log Source Type appear in the list.

The required configuration parameters appear. For more information about protocol parameters, see

sources. For more information, see

Select this check box to enable the log source. By default, the check box is selected.

From the drop-down list box, select the credibility of the bulk log source. The range is 0 to 10. The credibility indicates the integrity of an event or offense as determined by the credibility rating from the source devices. Credibility increases if multiple sources report the same event. The default is 5.

From the drop-down list box, select the Event Collector to use as the target for the log source.

Select this check box to enable the log source to coalesce (bundle) events. By default, the check box is selected.

Autodetected log sources use the default value configured in the Coalescing Events parameter in the

STRM

Administration Guide.

Select this check box to enable the log source to store event payload information. By default, the check box is selected.

Autodetected log sources use the default value configured in the Store Event Payload parameter in the

STRM

Administration Guide.

Log Source Users Guide

ANAGING

OURCES

Table 1-3 Adding a Bulk Log Source Parameters (continued)

Parameter

File Upload tab

Domain Query tab

Manual tab

Add

Description

Enables you to upload a text file containing a maximum of 500 IP addresses or host names of log sources you want to bulk add.

The text file should contain one IP address or host name per line. Extra characters after an IP address or host names longer than 255 characters result in an error indicating a log source from the host list could not be added.

•

Enables you to search a domain to add bulk log sources from a domain controller.

To search a domain you must add the domain, username, and password before polling the domain for hosts to add. Type values for the following parameters:

Domain Controller - Type the IP address of the domain controller.

Full Domain Name - Type a valid domain name.

Enables you to manually add an individual IP address or host name to the host list.

The add field is displayed when you have at least one log source in the host list. By default, the check box is selected. Clearing the check box from the add field allows you to ignore a log source.

Note: You are not required to clear check boxes for log sources that already exist. Duplicate host names or IP addresses are ignored.

Step 6

Click Save.

A summary of the added log sources is displayed.

Step 7

Click Continue.

Editing Multiple Log

Sources

Log sources that share a common protocol can be edited as a group as they share a configuration.

NOTE

You can use bulk editing to update host names or IP addresses, but not delete log

Deleting a Log Source

Step 1

To edit a bulk log source to your deployment, perform the following steps:

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

The Data Sources pane is displayed.

Step 3

Click the Log Sources icon.

Log Source Users Guide

Configuring

Protocols

Configuring Protocols

Step 4

The Log Sources window is displayed.

Select a bulk log source to edit from the list.

You must select one or more bulk log source from your active log sources list for the Bulk Edit drop-down menu to be available.

NOTE

To edit the log source name, log source description, log source identifier, or group, double-click the bulk log source.

Step 5

Using the Bulk Actions drop-down menu, select Bulk Edit.

Step 6

The Edit a bulk log source window is displayed.

Type values for the parameters you want to edit.

Step 7

For more information, see

Adding a Bulk Log Source Parameters

Click Save.

Step 8

A summary of the added log sources is displayed.

Click Continue.

The Log sources window is displayed.

When you select the type of log source from the Log Source Type drop-down list box, the protocol options for the selected log source is displayed in the Protocol

Configuration drop-down list box.

This section provides information on configuring the following protocols:

•

Syslog

•

JDBC

•

JDBC - SiteProtector

•

Sophos Enterprise Console - JDBC

•

Juniper Networks NSM

•

OPSEC/LEA

•

SDEE

•

SNMPv1

•

SNMPv2

•

SNMPv3

•

Sourcefire Defense Center Estreamer

•

Log File

•

Microsoft Security Event Log

•

Microsoft Security Event Log Custom

•

Microsoft Exchange

Log Source Users Guide

ANAGING

OURCES

•

Microsoft DHCP

•

Microsoft IIS

•

EMC VMWare

•

SMB Tail

•

Oracle Database Listener

•

Cisco Network Security Event Logging

•

PCAP Syslog Combination Protocol

Syslog

To configure the syslog protocol, you must define the IP address or hostname for the device in the Log Source Identifier parameter. The log source identifier must be unique for the log source type.

JDBC

To configure the JDBC protocol, define values for the following parameters:

Table 1-4 JDBC Parameters

Parameter

Log Source

Identifier

Description

Type the log source identifier in the following format:

<database>@<hostname>

<table name>|<database>@<hostname>

Where:

<table name>

is the name of the table or view of the database containing the event records. This parameter is optional. If you include the table name, you must include a pipe (|) character and the table name must match the Table Name parameter.

<database>

is the database name, as defined in the Database

Name parameter. The database name is a required parameter.

<hostname>

is the hostname or IP address for this log source, as defined in the IP or Hostname parameter. The hostname is a required parameter.

The log source identifier must be unique for the log source type.

Database Type From the drop-down list box, select the type of database to use for the event source. The options include MSDE, Postgres, MySQL,

Sybase, and Oracle. The default is MSDE.

Database Name Type the name of the database to which you want to connect.

The name can be up to 255 alphanumeric characters in length.

The name can include the following special characters: dollar sign

($), number sign (#), underscore (_), en dash (-), and period(.).

IP or Hostname Type the IP address or hostname of the database server.

Log Source Users Guide

Configuring Protocols

Table 1-4 JDBC Parameters (continued)

Parameter

Port

Username

Password

Description

Type the port number used by the database server. The default displayed depends on the selected Database Type. The valid range is 0 to 65536. The defaults include:

• MSDE - 1433

•

Postgres - 5432

•

MySQL - 3306

• Oracle - 1521

• Sybase - 1521

The JDBC configuration port must match the listener port of the database. The database must have incoming TCP connections enabled to communicate with STRM.

Note: If you define a Database Instance when using MSDE as the database type, you must leave the Port parameter blank in your

STRM configuration.

Type the database username. The username can be up to 255 alphanumeric characters in length. The username can include underscores (_).

Type the database password. The password can be up to 255 characters in length.

Confirm the password to access the database.

Confirm

Password

Authentication

Domain

Database

Instance

Table Name

If you select MSDE as the Database Type and the database is configured for Windows, you must define a Windows

Authentication Domain. Otherwise, leave this field blank.

The authentication domain must contain alphanumeric characters.

The domain can include the following special characters: underscore (_), en dash (-), and period(.).

If you select MSDE as the Database Type and you have multiple

SQL server instances on one server, define the instance to which you want to connect.

Note: If you use a non-standard port in your database configuration, or have blocked access to port 1434 for SQL database resolution, you must leave the Database Instance parameter blank in your STRM configuration.

Type the name of the table or view that includes the event records.

The table name can be up to 255 alphanumeric characters in length. The table name can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).

Log Source Users Guide

ANAGING

OURCES

Table 1-4 JDBC Parameters (continued)

Parameter

Select List

Description

Type the list of fields to include in the events. You can use a comma separated list or type * for all fields from the table or view.

You can use a comma-separated list to define specific fields from the tables or views. The list must contain the field defined in the

Compare Field parameter. The comma-separated list can be up to

255 alphanumeric characters in length. The list can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).

Compare Field Type a numeric value or timestamp field to use to identify new events added between queries to the table.

Start Date and

Time

The compare field can be up to 255 alphanumeric characters in length. The list can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).

Optional. Configure the start date and time for database polling.

The Start Date and Time parameter must be formatted as yyyy-MM-dd HH:mm with HH specified using a 24 hour clock. If the start date or time is clear, polling begins immediately and repeats at the specified polling interval.

Use Prepared

Statements

Select this check box to use prepared statements. Prepared statements allow the JDBC protocol source to setup the SQL statement, and then execute the SQL statement numerous times with different parameters. For security and performance reasons, we recommend that you use prepared statements.

Clear this check box to use an alternative method of querying that does not use pre-compiled statements.

Polling Interval Type the polling interval, which is the amount of time between queries to the event table. The default polling interval is 10 seconds.

EPS Throttle

You can define a longer polling interval by appending H for hours or M for minutes to the numeric value. The maximum polling interval is 1 week in any time format. Numeric values without an H or M designator poll in seconds.

Type the number of Events Per Second (EPS) that you do not want this protocol to exceed. The default value is 20000 EPS.

Use Named Pipe

Communication

If you select MSDE as the Database Type, select the check box to use an alternative method to a TCP/IP port connection.

Database

Cluster Name

When using a Named Pipe connection, the username and password must be the appropriate Windows authentication username and password and not the database username and password. Also, you must use the default Named Pipe.

If you select the Use Named Pipe Communication check box, the Database Cluster Name parameter is displayed. If you are running your SQL server in a cluster environment, define the cluster name to ensure Named Pipe communication functions properly.

Log Source Users Guide

Configuring Protocols

Table 1-4 JDBC Parameters (continued)

Parameter

Use NTLMv2

Description

If you select MSDE as the Database Type, the Use NTLMv2 check box is displayed.

Select the Use NTLMv2 check box to force MSDE connections to use the NTLMv2 protocol when communicating with SQL servers that require NTLMv2 authentication. The default value of the check box is selected.

If the Use NTLMv2 check box is selected, it has no effect on

MSDE connections to SQL servers that do not require NTLMv2 authentication.

Installing the MySQL Connector/J Driver

STRM Maintenance Release 3 and above are not installed with a MySQL driver for

JDBC. If you are using a DSM or protocol that requires a MySQL JDBC driver, you must download and install the platform independent MySQL Connector/J from http://dev.mysql.com/downloads/connector/j/.

Step 1

To install the MySQL JDBC driver:

Download the MySQL JDBC driver from the following website:

Step 2

http://dev.mysql.com/downloads/connector/j/

Copy the MySQL Connector/J zip file or tar.gz file to your STRM Console and

Event Collector.

Step 3

Type the following to extract the zip or tar.gz file on your appliance:

•

For zip: gzip -d mysql-connector-java-<version>.zip

•

For tar.gz: tar -zxvf mysql-connector-java-<version>.tar.gz

The extracted zip or tar.gz contains the file mysql-connector-java-<version>.jar.

The extracted files are located in a mysql-connector-java-<version> folder.

Step 4

Navigate to the mysql-connector-java-<version> folder.

Step 5

Type the following to copy the MySQL Connector/J jar to the proper directory:

cp mysql-connector-java-<version>-bin.jar /opt/qradar/jars

Step 6

Type the following command to restart Tomcat:

service tomcat restart

Step 7

Type the following command to restart the Event Collection System (ECS):

service ecs restart

Log Source Users Guide

ANAGING

OURCES

CAUTION

Restarting the Event Collection System (ECS) service stops all event collection for STRM until the service restarts.

After the service restarts, the installation of the MySQL driver is complete. For more information on installing or using MySQL Connector/J, see http://dev.mysql.com/downloads/connector/j/.

JDBC - SiteProtector

The JDBC - SiteProtector protocol combines information from the SensorData1 and SensorDataAVP1 tables in the creation of the log source payload. The

SensorData1 and SensorDataAVP1 tables are located in the IBM Proventia

Management SiteProtector database.

To configure the JDBC - SiteProtector protocol, define values for the following parameters:

Table 1-5 JDBC - SiteProtector Parameters

Parameter

Log Source

Identifier

Description

Type the identifier for the log source. Configure the log source identifier in the following format:

<database>@<hostname>

Where:

<database>

is the database name, as configured in the

Database Name parameter.

<hostname>

is the hostname or IP address for this log source, as configured in the IP or Hostname parameter.

The log source identifier must be unique for the log source type.

Database Type From the drop-down list box, select the type of database to use for the event source. The default is MSDE.

Database Name Type the name of the database to which you want to connect. The default database name is RealSecureDB.

IP or Hostname Type the IP address or hostname of the database server.

Port Type the port number used by the database server. The default that is displayed depends on the selected Database Type. The valid range is 0 to 65536. The default for MSDE is port 1433.

Username

Password

Type the database username. The username can be up to 255 alphanumeric characters in length. The username can include underscores (_).

Type the database password. The password can be up to 255 characters in length.

Log Source Users Guide

Configuring Protocols

Table 1-5 JDBC - SiteProtector Parameters (continued)

Parameter

Table Name

Select List

Description

Type the name of the table or view that includes the event records.

The default table name is SensorData1.

Type the list of fields to include in the events. You can use a comma separated list or type * for all fields from the table or view.

You can use a comma-separated list to define specific fields from the tables or views. The list must contain the field defined in the

Compare Field parameter. The comma-separated list can be up to

255 alphanumeric characters in length. The list can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).

Compare Field Type a numeric value or timestamp field to use to identify new events added between queries to the table. The default is

SensorDataRowID

Polling Interval Type the polling interval, which is the number of seconds between queries to the event table. The valid range is between 1 and 60 and the default is 10.

Sophos Enterprise

Console - JDBC

The Sophos Enterprise Console - JDBC protocol combines payload information from application control logs, device control logs, data control logs, tamper protection logs, and firewall logs in the vEventsCommonData table to provide events to STRM.

NOTE

If your Sophos Enterprise Console does not have the Sophos Reporting Interface, you can collect Anti-Virus events using the JDBC protocol. For more information on configuring Sophos Enterprise Console using the JDBC protocol, see the

Configuring DSMs Guide.

To use the Sophos Enterprise Console - JDBC protocol, you must ensure that the

Sophos Reporting Interface is installed with your Sophos Enterprise Console.

Log Source Users Guide

ANAGING

OURCES

If the Sophos Reporting Interface is installed, you can configure values for the following parameters:

Table 1-6 Sophos Enterprise Console JDBC Parameters

Parameter

Log Source

Identifier

Description

Type the identifier for the log source. Type the log source identifier in the following format:

<Sophos Database>@<Sophos Database Server IP or

Host Name>

Confirm

Password

Authentication

Domain

Database

Instance

Where:

<Sophos Database>

is the database name, as entered in the

Database Name parameter.

<Sophos Database Server IP or Host Name>

is the hostname or IP address for this log source, as entered in the IP or

Hostname parameter.

Note: When defining a name for your log source identifier, you must use the values of the Sophos Database and Database Server

IP address or hostname from the Management Enterprise

Console.

Database Type From the drop-down list box, select MSDE.

Database Name Type the exact name of the Sophos database.

IP or Hostname Type the IP address or host name of the Sophos SQL Server.

Port Type the port number used by the database server. The default port for MSDE in Sophos Enterprise Console is 1168.

The JDBC configuration port must match the listener port of the

Sophos database. The Sophos database must have incoming TCP connections enabled to communicate with STRM.

Note: If you define a Database Instance when using MSDE as the database type, you must leave the Port parameter blank in your

STRM configuration.

Username

Password

Type the username required to access the database.

Type the password required to access the database. The password can be up to 255 characters in length.

Confirm the password required to access the database. The confirmation password must be identical to the password entered in the Password parameter.

If you select MSDE as the Database Type and the database is configured for Windows, you must define a Window Authentication

Domain. Otherwise, leave this field blank.

Optional. Type the database instance, if you have multiple SQL server instances on your database server.

Log Source Users Guide

Configuring Protocols

Table 1-6 Sophos Enterprise Console JDBC Parameters (continued)

Parameter

Table Name

Select List

Description

Type vEventsCommonData as the name of the table or view that includes the event records.

Type * for all fields from the table or view.

You can use a comma-separated list to define specific fields from tables or views. The list must contain the field defined in the

Compare Field parameter. The comma-separated list can be up to

255 alphanumeric characters in length. The list can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period(.).

Compare Field Type InsertedAt as the compare field. The compare field is used to identify new events added between queries to the table.

Start Date and

Time

Optional. Type the start date and time for database polling.

Polling Interval Type the polling interval, which is the amount of time between queries to the event table. The default polling interval is 10 seconds.

EPS Throttle

You can define a longer polling interval by appending H for hours or M for minutes to the numeric value. The maximum polling interval is 1 week in any time format. Numeric values entered without an H or M poll in seconds.

Type the number of Event Per Second (EPS) that you do not want this protocol to exceed. The default value is 20000 EPS.

Use Named Pipe

Communication

Clear the Use Named Pipe Communications check box.

Database

Cluster Name

If you select the Use Named Pipe Communication check box, the

Database Cluster Name parameter is displayed. If you are running your SQL server in a cluster environment, define the cluster name to ensure Named Pipe communication functions properly.

Juniper Networks

NSM

To configure the Juniper Networks NSM protocol, define values for the following parameters:

Table 1-7 Juniper NSM Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source. This value must match the value configured in the IP parameter.

The log source identifier must be unique for the log source type.

Log Source Users Guide

ANAGING

OURCES

Table 1-7 Juniper NSM Parameters (continued)

Parameter

Inbound Port

Redirection Listen

Port

Use NSM Address for

Log Source

Description

Type the IP address or hostname of the Juniper Networks

NSM server.

Type the port to which the Juniper Networks NSM sends communications.The valid range is 0 to 65536. The default is

514.

Specifies the port to which traffic is forwarded. The valid range is 0 to 65,536. The default is 516.

Select this check box if you want to use the Juniper NSM server’s IP address instead of the managed log source’s IP address for a log source. By default, the check box is selected.

OPSEC/LEA

To configure the OPSEC/LEA protocol, define values for the following parameters:

Table 1-8 OPSEC/LEA Parameters

Parameter

Log Source

Identifier

Server IP

Server Port

Use Server IP for

Log Source

Statistics Report

Interval

Description

Type the IP address for the log source. This value must match the value configured in the Server IP parameter.

The log source identifier must be unique for the log source type.

Type the IP address of the server.

Type the port used for OPSEC communication. The valid range is 0 to 65,536 and the default is 18184.

Select this check box if you want to use the LEA server’s IP address instead of the managed device’s IP address for a log source. By default, the check box is selected.

Type the interval, in seconds, during which the number of syslog events are recorded in the qradar.log file. The valid range is 4 to

2,147,483,648 and the default is 600.

Log Source Users Guide

Configuring Protocols

Table 1-8 OPSEC/LEA Parameters (continued)

Parameter

Authentication

Type

•

Description

From the drop-down list box, select the authentication type you want to use for this LEA configuration. The options are sslca

(default), sslca_clear, or clear. This value must match the authentication method used by the server. The following parameters appear if sslca or sslca_clear is selected as the authentication type.

OPSEC Application Object SIC Attribute (SIC Name) -

Type the Secure Internal Communications (SIC) name of the

OPSEC Application Object. The SIC name is the distinguished name (DN) of the application, for example:

CN=LEA, o=fwconsole..7psasx.

The name can be up to 255 characters in length and is case sensitive.

Log Source SIC Attribute (Entity SIC Name) - Type the SIC name of the server, for example:

cn=cp_mgmt,o=fwconsole..7psasx.

The name can be up to 255 characters in length and is case sensitive.

Specify Certificate - Select this check box if you want to define a certificate for this LEA configuration. STRM attempts to retrieve the certificate using these parameters when the certificate is required.

If you select the Specify Certificate check box, the Certificate

Filename parameter is displayed:

Certificate Filename - This option only appears if Specify

Certificate is selected. Type the directory path of the certificate you want to use for this configuration.

If you clear the Specify Certificate check box, the following parameters appear:

Certificate Authority IP - Type the IP address of the

SmartCenter server from which you want to pull your certificate.

Pull Certificate Password - Type the password you want to use when requesting a certificate. The password can be up to

255 characters in length.

OPSEC Application - Type the name of the application you want to use when requesting a certificate. This value can be up to 255 characters in length.

Log Source Users Guide

ANAGING

OURCES

SDEE

To configure the SDEE protocol, define values for the following parameters:

Table 1-9 SDEE Parameters

Parameter

Log Source

Identifier

URL

Description

Type the IP address or hostname for the log source. This value must match the hostname or IP address portion of the URL configured in the URL parameter.

The log source identifier must be unique for the log source type.

Type the URL required to access the log source, for example, https://www.mysdeeserver.com/cgi-bin/sdee-server. You must use an http or https URL.

If you are using RDEP (for Cisco IDS v4.0), the URL should have /cgi-bin/event-server at the end. For example:

https://www.my-rdep-server.com/cgi-bin/eventserver

Username

Password

If you are using SDEE/CIDEE (for Cisco IDS v5.x and above), the URL should have /cgi-bin/sdee-server at the end. For example:

https://www.my-sdee-server/cgi-bin/sdee-server

Type the username. This username must match the SDEE URL username used to access the SDEE URL. The username can be up to 255 characters in length.

Type the user password. This password must match the SDEE

URL password used to access the SDEE URL. The password can be up to 255 characters in length.

Max Events Per

Query

Type the maximum number of events to retrieve per query. The valid range is 0 to 501 and the default is 100.

Force Subscription Select this check box if you want to force a new SDEE subscription. By default, the check box is selected.

The check box forces the server to drop the least active connection and accept a new SDEE subscription connection for this log source.

Clearing the check box continues with any existing SDEE subscription.

Severity Filter Low Select this check box if you want to configure the severity level as low.

Severity Filter

Medium

Log sources that support SDEE return only the events that match this severity level. By default, the check box is selected.

Select this check box if you want to configure the severity level as medium.

Log sources that supports SDEE returns only the events that match this severity level. By default, the check box is selected.

Severity Filter High Select this check box if you want to configure the severity level as high.

Log sources that supports SDEE returns only the events that match this severity level. By default, the check box is selected.

Log Source Users Guide

Configuring Protocols

SNMPv1

To configure the SNMPv1 protocol, you must type the IP address for the log source in the Log Source Identifier parameter. The log source identifier must be unique for the log source type.

SNMPv2

To configure the SNMPv2 protocol, define values for the following parameters:

Table 1-10 SNMPv2 Parameters

Parameter

Log Source

Identifier

Community

Description

Type the IP address for the log source. The log source identifier must be unique for the log source type.

Type the SNMP community, such as public. The default is

Public.

SNMPv3

To configure the SNMPv3 protocol, define values for the following parameters:

Table 1-11 SNMPv3 Parameters

Parameter

Authentication

Protocol

Description

Log Source Identifier Type the IP address for the log source. The log source identifier must be unique for the log source type.

From the drop-down list box, select the algorithm you want to use to authenticate SNMP traps. This parameter is required if you are using SNMPv3. The default is MD5.

Authentication

Password

Type the password you want to use to authenticate SNMP.

This parameter is required if you are using SNMPv3. The password can be up to 64 characters in length.

Decryption Protocol From the drop-down list box, select the protocol you want to use to decrypt SNMP traps. This parameter is required if you are using SNMPv3. The default is AES256.

Decryption Password Type the password used to decrypt SNMP traps. This parameter is required if you are using SNMPv3. The password can be up to 64 characters in length.

User Type the user access for this protocol. The default is

AdminUser. The username can be up to 255 characters in length.

Sourcefire Defense

Center Estreamer

The Sourcefire Defense Center Estreamer protocol allows STRM to receive streaming event data from a Sourcefire Defense Center Estreamer (Event

Streamer) service. Event files are streamed to STRM for processing after you have configured the Sourcefire Defense Center DSM. For more information about your

Sourcefire Defense Center DSM, see the Configuring DSMs Guide.

Log Source Users Guide

ANAGING

OURCES

Table 1-12 Sourcefire Defense Center Estreamer Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname to identify the log source.

The information in the Log Source Identifier field must be unique to the log source type.

Server Address

Server Port

Type the IP address or hostname of the Sourcefire Defense

Center device.

Type the port number STRM uses to receive Sourcefire

Defense Center Estreamer events. The default is 8302.

Keystore Filename Type the directory path and file name for the keystore private key and associated certificate.

By default, the import script creates the keystore file in the following directory:

/opt/qradar/conf/estreamer.keystore

Truststore Filename Type the directory path and file name for the truststore files.

The truststore file contain the certificates trusted by the client.

By default, the import script creates the truststore file in the following directory:

/opt/qradar/conf/estreamer.truststore

Log File

A log file protocol source allows STRM to retrieve archived log files from a remote host. These files are transferred, one at a time, to STRM for processing. The log file protocol can manage plain text, compressed files, or archives. Archives must contain plain-text files that can be processed one line at a time. When a protocol source downloads a file for processing, STRM processes the information received in the file to generate events, as necessary. If additional information is written to the file after the download is complete, that information is not processed by STRM.

To configure the Log File protocol, define values for the following parameters:

Table 1-13 Log File Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source. This value must match the value configured in the Remote Host IP

or Hostname parameter.

The log source identifier must be unique for the log source type.

Log Source Users Guide

Configuring Protocols

Table 1-13 Log File Parameters (continued)

Parameter

Service Type

Remote IP or

Hostname

Remote Port

Remote User

Remote Password

Confirm Password

SSH Key File

Remote Directory

Recursive

FTP File Pattern

•

Description

From the drop-down list box, select the protocol you want to use when retrieving log files from a remove server. The default is SFTP.

SFTP - SSH File Transfer Protocol

FTP - File Transfer Protocol

•

SCP - Secure Copy

Note: The underlying protocol used to retrieve log files for the

SCP and SFTP service type requires that the server specified in the Remote IP or Hostname field has the SFTP subsystem enabled.

Type the IP address or hostname of the host from which you want to receive files.

Type the TCP port on the remote host that is running the selected Service Type. If you configure the Service Type as

FTP, the default is 21. If you configure the Service Type as

SFTP or SCP, the default is 22. The valid range is 1 to 65535.

Type the username necessary to log in to the host running the selected Service Type. The username cancan be up to 255 characters in length.

Type the password necessary to log in to the host running the selected Service Type.

Confirm the Remote Password to log in to the host running the selected Service Type.

If you select SCP or SFTP as the Service Type, this parameter allows you to define an SSH private key file. When you provide an SSH Key File, the Remote Password option is ignored.

Type the directory location on the remote host from which the files are retrieved.

Select this check box if you want the file pattern to search sub folders. By default, the check box is clear.

The Recursive parameter is not used if you configure SCP as the Service Type.

If you select SFTP or FTP as the Service Type, this option allows you to configure the regular expression (regex) required to filter the list of files specified in the Remote

Directory. All matching files are included in the processing.

For example, if you want to list all files starting with the word log, followed by one or more digits and ending with tar.gz, use the following entry: log[0-9]+\.tar\.gz. Use of this parameter requires knowledge of regular expressions (regex).

For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/

Log Source Users Guide

ANAGING

OURCES

Table 1-13 Log File Parameters (continued)

Parameter Description

FTP Transfer Mode This option only appears if you select FTP as the Service

Type. The FTP Transfer Mode parameter allows you to define the file transfer mode when retrieving log files over FTP.

From the drop-down list box, select the transfer mode you want to apply to this log source:

•

Binary - Select Binary for log sources that require binary data files or compressed zip, gzip, tar, or tar+gzip archive files.

ASCII - Select ASCII for log sources that require an ASCII

FTP file transfer.

SCP Remote File

Start Time

Recurrence

Run On Save

EPS Throttle

You must select NONE for the Processor parameter and

LINEBYLINE the Event Generator parameter when using

ASCII as the FTP Transfer Mode.

If you select SCP as the Service Type you must type the file name of the remote file.

Type the time of day you want the processing to begin. This parameter functions with the Recurrence value to establish when and how often the Remote Directory is scanned for files.

Type the start time, based on a 24 hour clock, in the following format: HH:MM.

Type the frequency, beginning at the Start Time, that you want the remote directory to be scanned. Type this value in hours (H), minutes (M), or days (D). For example, 2H if you want the directory to be scanned every 2 hours. The default is

1H.

Select this check box if you want the log file protocol to run immediately after you click Save. After the Run On Save completes, the log file protocol follows your configured start time and recurrence schedule.

Selecting Run On Save clears the list of previously processed files for the Ignore Previously Processed File parameter.

Type the number of Events Per Second (EPS) that you do not want this protocol to exceed. The valid range is 100 to 5000.

Processor

Ignore Previously

Processed File(s)

Change Local

Directory?

If the files located on the remote host are stored in a zip, gzip, tar, or tar+gzip archive format, select the processor that allows the archives to be expanded and contents processed.

Select this check box to track files that have already been processed and you do not want the files to be processed a second time. This only applies to FTP and SFTP Service

Types.

Select this check box to define the local directory on your

STRM system that you want to use for storing downloaded files during processing. We recommend that you leave the check box clear. When the check box is selected, the Local

Directory field is displayed, which allows you to configure the local directory to use for storing files.

Log Source Users Guide

Configuring Protocols

Table 1-13 Log File Parameters (continued)

Parameter

Event Generator

•

Description

The Event Generator applies additional processing to the retrieved event files.

•

From the Event Generator drop-down list box, select one of the following options:

LineByLine - Each line of the file configures STRM as a single payload. For example, if a file has 10 lines of text, 10 separate events are created.

HPTandem - The file is processed as a

HPTandem/NonStop binary audit log. Each record in the log file (whether primary or secondary) is converted into text and processed as a single event. HPTandem audit logs use the following filename pattern: “[aA]\d{7}”.

WebSphere Application Server - Processes the log files containing WebSphere Application Server events generated from the WebSphere Application Server DSM.

The remote directory must define the file path configured in the DSM. For more information, see the Configuring DSMs

Guide.

W3C - Processes log files from sources using the w3c format. The header of the log file identifies the order and data contained in each line of the file. For more information, see the Configuring DSMs Guide.

Fair Warning - Processes log files from Fair Warning devices protecting patient identity and medical information.

The remote directory must define the file path containing the event log files generated by your Fair Warning device.

For more information, see the Configuring DSMs Guide.

DPI Subscriber Data - The file is processed as a DPI statistic log produced by a Juniper Networks MX router.

The header of the file identifies the order and data contained in each line of the file. Each line in the file after the header is formatted to a tab-delimited name=value pair event to be processed by STRM.

SAP Audit Logs - Process files for SAP Audit Logs to keep a record of security-related events in SAP systems.

Each line of the file is formatted to be processed by STRM.

Oracle BEA WebLogic - Processes files for Oracle BEA

WebLogic application log files. Each line of the file is formatted to be processed by STRM.

Microsoft Security

Event Log

The Microsoft Security Event Log protocol provides remote agentless Windows event log collection for Windows server versions 2000, 2003, 2008, Windows XP,

Windows Vista, and Windows 7 using the Microsoft Windows Management

Instrumentation (WMI) API. The Windows Event Log protocol processes

Application, Security, System, DNS Server, File Replication, and Directory Service

Log Source Users Guide

ANAGING

OURCES logs. The log files are used in conjunction with the Microsoft Windows Security

Event Log DSM.

You must configure your firewall to accept incoming external communications on port 135 and any dynamic ports required for DCOM. For more information on configuring DCOM, see your Microsoft Support documentation.

The following log source limitations apply when deploying the Microsoft Security

Event Log Protocol in your environment:

• A STRM all-in-one installation can support up to 250 log sources using the

Microsoft Security Event Log Protocol.

• A dedicated Event Collector can support up to 500 log sources using the

Microsoft Security Event Log Protocol.

NOTE

The Microsoft Security Event Log protocol is not recommended for remote servers accessed over network links with high round-trip delay times, such as satellite or slow WAN networks. Round-trip delay can be confirmed by examining request and response time between servers using ping. Network delays created by slow connections decrease the EPS throughput available to those remote servers. In addition, event collection from busy servers or Domain Controllers rely on low round-trip delay times to keep up with incoming events. If it is not possible to decrease your network round-trip delay time, we recommend you consider using the Adaptive Log Exporter or Snare. For more information on the Adaptive Log

Exporter, see the Adaptive Log Exporter Users Guide.

To configure the Microsoft Security Event Log protocol, define values for the following parameters:

Table 1-14 Microsoft Security Event Log Parameters

Parameter

Domain

Description

Log Source Identifier Type the IP address or hostname of the Windows host. The log source identifier must be unique for the log source type.

Type the Windows domain that includes the Windows

Machine specified above. This parameter is optional.

User Name

Password

Confirm Password

Type the username required to access the Windows host.

Type the password required to access the Windows host.

Confirm the password required to access the Windows host.

Log Source Users Guide

Configuring Protocols

Table 1-14 Microsoft Security Event Log Parameters (continued)

Parameter Description

Standard Log Types Select any check boxes for the Windows log type you want

STRM to monitor. At least one check box must be selected.

•

The log types include:

Security

System

Application

Event Types

•

DNS Server

File Replication Service

•

Directory Service

Select any check boxes for the event type you want STRM to monitor. At least one check box must be selected.

•

The event types include:

Informational

Warning

Error

Success Audit

Failure Audit

Microsoft Security

Event Log Custom

The Microsoft Security Event Log Custom protocol provides remote agentless

Windows event log collection for Windows server versions 2000, 2003, 2008,

Windows XP, Windows Vista, and Windows 7 using the Microsoft Windows

Management Instrumentation (WMI) API. The Microsoft Security Event Log

Custom protocol can process any Windows EVT log files and is used in conjunction with the Universal DSM.

The following log source limitations apply when deploying the Microsoft Security

Event Log Custom protocol in your environment:

• A STRM all-in-one installation can support up to 250 log sources using the

Microsoft Security Event Log Custom protocol.

• A dedicated Event Collector can support up to 500 log sources using the

Microsoft Security Event Log Custom protocol.

Log Source Users Guide

ANAGING

OURCES

NOTE

The Microsoft Security Event Log Custom protocol is not recommended for remote servers accessed over network links with high round-trip delay times, such as satellite or slow WAN networks. Round-trip delay can be confirmed by examining request and response time between servers using ping. Network delays created by slow connections decrease the EPS throughput available to those remote servers. In addition, event collection from busy servers or Domain

Controllers rely on low round-trip delay times to keep up with incoming events. If it is not possible to decrease your network round-trip delay time, we recommend you consider using the Adaptive Log Exporter or Snare. For more information on the Adaptive Log Exporter, see the Adaptive Log Exporter Users Guide.

To configure the Windows Event Log Custom protocol, define values for the following parameters:

Table 1-15 Windows Event Log Custom Parameters

Parameter

Domain

Description

Log Source Identifier Type the IP address or hostname of the Windows host. The log source identifier must be unique for the log source type.

Type the Windows domain that includes the Windows

Machine specified above. This parameter is optional.

User Name

Password

Type the username required to access the Windows host.

Type the password required to access the Windows host.

Confirm Password Confirm the password required to access the Windows host.

Monitored Event Logs Type the display name of the Windows event logs you want to process. Type multiple event logs in a comma separated list.

Event Types Select any check boxes for the event type you want STRM to monitor. At least one check box must be selected.

•

The event types include:

Informational

Warning

Error

Success Audit

Failure Audit

Microsoft Exchange

The Microsoft Windows Exchange protocol supports SMTP, OWA, and message tracking logs for Microsoft Exchange 2007. The Microsoft Exchange protocol does not support Microsoft Exchange 2003 or Microsoft authentication protocol NTLMv2

Session.

Log Source Users Guide

Configuring Protocols

NOTE

Parameters that support file paths allow you to define a drive letter with the path information. For example, you can use c$/LogFiles/ for an administrative share, or LogFiles/ for a public share folder path, but not c:/LogFiles.

NOTE

If a log folder path contains an administrative share (C$), users with NetBIOS access on the administrative share (C$) have the proper access required to read the log files. Local or domain administrators have sufficient privileges to access log files that reside on administrative shares. Clearing the file path information from any log folder path field disables monitoring for that log type.

To configure the Windows Exchange protocol, define values for the following parameters:

Table 1-16 Microsoft Exchange Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source. This value must match the value configured in the Server Address parameter.

Server Address

Domain

Username

Password

Confirm Password

Type the IP address of the Microsoft Exchange server.

Type the domain required to access the Microsoft Exchange server. This parameter is optional.

Type the username required to access the Microsoft

Exchange server.

Type the password required to access the Microsoft

Exchange server.

Confirm the password required to access the Microsoft

Exchange server.

SMTP Log Folder Path Type the directory path to access the SMTP log files. The default is Program Files/Microsoft/Exchange

Server/TransportRoles/Logs/ProtocolLog/.

Clearing the file path information from the SMTP Log Folder

Path field disables SMTP monitoring.

OWA Log Folder Path Type the directory path to access the OWA log files. The default is Windows/system32/LogFiles/W3SVC1.

MSGTRK Log Folder

Path

Clearing the file path information from the OWA Log Folder

Path field disables OWA monitoring.

Type the directory path to access message tracking log files.

The default is /Program Files/Microsoft /Exchange

Server/TransportRoles/Logs/ MessageTracking/

Message tracking is only available on Microsoft Exchange

2007 servers assigned the Hub Transport, Mailbox, or Edge

Transport server role.

Log Source Users Guide

ANAGING

OURCES

Table 1-16 Microsoft Exchange Parameters (continued)

Parameter

File Pattern

Force File Read

Recursive

Polling Interval (in seconds)

Throttle Events/Sec

Description

Type the regular expression (regex) required to filter the filenames. All matching files are included in the processing.

The default is .*\.(?:log|LOG)

For example, to list all files starting with the word log, followed by one or more digits and ending with tar.gz, use the following entry: log[0-9]+\.tar\.gz. Use of this parameter requires knowledge of regular expressions (regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/

Select this check box to force the protocol to read the log file.

By default, the check box is selected.

If the check box is cleared, the log file is read when the log file modified time or file size attributes change.

Select this check box if you want the file pattern to search sub folders. By default, the check box is selected.

Type the polling interval, which is the number of seconds between queries to the log files to check for new data. The minimum polling interval is 10 seconds, with a maximum polling interval of 3,600 seconds. The default is 10 seconds.

Type the maximum number of events the Microsoft

Exchange protocol forwards every second. The minimum value is 100 EPS and the maximum is 20,000 EPS. The default value is 100 EPS.

Microsoft DHCP

The Microsoft DHCP protocol only supports a single connection to a Microsoft

DHCP server. The Microsoft authentication protocol NTLMv2 Session is not supported in the Microsoft DHCP Log Source. To configure the Microsoft DHCP protocol, define values for the following parameters:

Table 1-17 Microsoft DHCP Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source. This value must match the value configured in the Server Address parameter.

Server Address

Domain

Type the IP address of the Microsoft DHCP server.

Type the domain required to access the Microsoft DHCP server. This parameter is optional.

Username

Password

Confirm Password

Type the username required to access the Microsoft DHCP server.

Type the password required to access the Microsoft DHCP server.

Confirm the password required to access the Microsoft

DHCP server.

Log Source Users Guide

Configuring Protocols

Table 1-17 Microsoft DHCP Parameters (continued)

Parameter

Folder Path

File Pattern

Recursive

Polling Interval (in seconds)

Throttle Events/Sec

Description

Type the directory path to access the DHCP log files. The default is /WINDOWS/system32/dhcp/.

Users with NetBIOS access on the administrative share (C$) have the proper access to read DHCP log files in

/WINDOWS/system32/dhcp/.

Local or domain administrators have sufficient privileges to access DHCP log files.

Type the regular expression (regex) required to filter the filenames. All matching files are included in the processing.

Note: Your Microsoft DHCP audit log files must contain a three-character abbreviation for a day of the week.

The default IPv4 file pattern:

DhcpSrvLog-(?:Sun|Mon|Tue|Wed|Thu|Fri|

Sat)\.log

Optional. IPv6 file pattern:

DhcpV6SrvLog-(?:Sun|Mon|Tue|Wed|Thu|Fri|Sat)

\.log

Optional. IPv4 and IPv6 file pattern:

Dhcp.*SrvLog-(?:Sun|Mon|Tue|Wed|Thu|Fri|Sat)

\.log

Use of this parameter requires knowledge of regular expressions (regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/

Select this check box if you want the file pattern to search sub folders. By default, the check box is clear.

Type the maximum number of events the Microsoft DHCP protocol forwards every second. The minimum value is 100

EPS and the maximum is 20,000 EPS. The default value is

100 EPS.

Log Source Users Guide

ANAGING

OURCES

Microsoft IIS

Microsoft IIS protocol supports a single point collection of .w3c format log files from a Microsoft IIS web server. The Microsoft authentication protocol NTLMv2 Session is not supported in the Microsoft IIS protocol. To configure the Microsoft IIS protocol, define values for the following parameters:

To configure the Microsoft IIS protocol, define values for the following parameters:

Table 1-18 Microsoft IIS Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source.

Server Address

Username

Type the IP address of the Microsoft IIS server.

Type the username required to access the Microsoft IIS server.

Password

Confirm Password

Domain

Folder Path

Type the password required to access the Microsoft IIS server.

Confirm the password required to access the Microsoft IIS server.

Type the domain required to access the Microsoft IIS server.

File Pattern

Type the directory path to access the IIS log files. The default is /WINDOWS/system32/LogFiles/W3SVC1/.

Parameters that support file paths allow you to define a drive letter with the path information. For example, you can use

c$/LogFiles/

for an administrative share or LogFiles/ for a public share folder path, but not c:/LogFiles.

Type the regular expression (regex) required to filter the filenames. All matching files are included in the processing.

The default is (?:u_)?ex.*\.(?:log|LOG)

Recursive

Polling Interval (s)

Select this check box if you want the file pattern to search sub folders. By default, the check box is selected.

Type the polling interval, which is the number of seconds between queries to the log files to check for new data. The default is 10 seconds.

Log Source Users Guide

Configuring Protocols

EMC VMWare

The EMC VMWare protocol allows STRM to receive event data from the VMWare

Web service for virtual environments.

To configure the EMC VMWare protocol, define values for the following parameters:

Table 1-19 VMWare Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source.

ESX IP

User Name

Password

Type the IP address of the VMWare server.

Type the username required to access the VMWare server.

Type the password required to access the VMWare server.

SMB Tail

To configure the SMB Tail protocol, define values for the following parameters:

Table 1-20 SMB Tail Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source.

Server Address

Domain

Type the IP address of the server.

Type the domain required to access the server. This parameter is optional.

Username

Password

Confirm Password

Log Folder Path

Type the username required to access the server.

Type the password required to access the server.

Confirm the password required to access the server.

Type the directory path to access the log files.

File Pattern

Parameters that support file paths allow you to define a drive letter with the path information. For example, you can use

c$/LogFiles/

for an administrative share, or LogFiles/ for a public share folder path, but not c:/LogFiles.

Type the regular expression (regex) required to filter the filenames. All matching files are included in the processing.

(regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/

Log Source Users Guide

ANAGING

OURCES

Table 1-20 SMB Tail Parameters (continued)

Parameter

Force File Read

Recursive

Polling Interval (in seconds)

Throttle Events/Sec

Description

Select this check box to force the protocol to read the log file.

By default, the check box is selected.

If the check box is cleared, the log file is read when the log file modified time or file size attributes change.

Select this check box if you want the file pattern to search sub folders. By default, the check box is selected.

Type the maximum number of events the SMB Tail protocol forwards per second. The minimum value is 100 EPS and the maximum is 20,000 EPS. The default is 100 EPS.

Oracle Database

Listener

The Oracle Database Listener protocol source allows STRM to monitor log files generated from an Oracle Listener database. Before you configure the Oracle

Database Listener protocol to monitor log files for processing, you must obtain the directory path to the Oracle Listener database log files.

To configure the Oracle Database Listener protocol, define values for the following parameters:

Table 1-21 Oracle

Database

Listener Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source. This value must match the value configured in the Server Address parameter.

Server Address

Domain

Username

Password

Type the IP address of the Oracle Database Listener.

Type the domain required to access the Oracle Database

Listener. This parameter is optional.

Type the username required to access the host running the

Oracle Database Listener.

Type the password required to access the host running the

Oracle Database Listener.

Confirm Password

Log Folder Path

Confirm the password required to access the Oracle

Database Listener.

Type the directory path to access the Oracle Database

Listener log files.

Log Source Users Guide

Configuring Protocols

Table 1-21 Oracle

Database

Listener Parameters (continued)

Parameter

File Pattern

Force File Read

Recursive

Polling Interval (in seconds)

Throttle Events/Sec

Description

Type the regular expression (regex) required to filter the filenames. All matching files are included in the processing.

The default is listener\.log

This parameter does not accept wildcard or globbing patterns in the regular expression. For example, if you want to list all files starting with the word log, followed by one or more digits and ending with tar.gz, use the following entry: log[0-9]+\.tar\.gz. Use of this parameter requires knowledge of regular expressions (regex). For more information, see the following website: http://download.oracle.com/javase/tutorial/essential/regex/

Select this check box to force the protocol to read the log file when the timing of the polling interval specifies.

When the check box is selected, the log file source is always examined when the polling interval specifies, regardless of the last modified time or file size attribute.

When the check box is not selected, the log file source is examined at the polling interval if the last modified time or file size attributes have changed.

Select this check box if you want the file pattern to search sub folders. By default, the check box is selected.

Type the maximum number of events the Oracle Database

Listener protocol forwards per second. The minimum value is

100 EPS and the maximum is 20,000 EPS. The default is

100 EPS.

Cisco Network

Security Event

Logging

The Cisco Network Security Event Logging (NSEL) protocol source allows STRM to monitor NetFlow packet flows from a Cisco Adaptive Security Appliance (ASA).

NetFlow events are streamed to STRM for processing after you have configured the Cisco ASA DSM. For more information, see the Configuring DSMs Guide.

To configure the Cisco NSEL protocol, define values for the following parameters:

Table 1-22 Cisco NSEL Parameters

Parameter Description

Log Source Identifier Type the IP address or hostname for the log source.

Log Source Users Guide

ANAGING

OURCES

Table 1-22 Cisco NSEL Parameters (continued)

Parameter

Collector Port

Description

Type the UDP port number used by Cisco ASA to forward

NSEL events. The valid range of the Collector Port parameter is 1-65535.

Note: STRM typically uses port 2055 for NetFlow event data on QFlow Collectors. You must define a different UDP port on your Cisco Adaptive Security Appliance for NetFlow using

NSEL.

PCAP Syslog

Combination

Protocol

The PCAP Syslog Combination protocol allows Juniper Networks SRX-series appliances to forward packet capture (PCAP) data from a Juniper Networks SRX appliance to STRM. Packet capture data is forwarded to STRM on a specified port that is separate from the syslog data forwarded to STRM on port 514. The data contained in the packet capture and the outgoing port from the Juniper Networks

SRX-series is configured from the Juniper Networks SRX-series appliance user interface. STRM is capable or receiving both syslog and the additional PCAP data after you have configured the Juniper Networks SRX-series appliance. For more information on Configuring Packet Capture, see your Juniper Networks JunOS documentation.

NOTE

Your STRM system must be running the latest version of the STRM Juniper

JunOS Platform DSM to receive PCAP data from a Juniper Networks SRX-series appliance.

To configure the Juniper Networks SRX PCAP protocol, enter values for the following parameters:

Table 1-23 PCAP Syslog Combination Protocol Parameters

Parameter Description

Log Source Identifier Specify the IP address or hostname for the log source.

Incoming PCAP Port Specify the port number used by the Juniper Networks

SRX-series appliance to forward incoming PCAP data to

STRM. The PCAP UDP port number must be configured from your Juniper SRX-series appliance.

If you change the outgoing PCAP port on your Juniper

Networks SRX-series appliance, you must change the log source Incoming PCAP Port parameter and complete a Full

Deploy before the changes take effect. A Full Deploy stops event collection until all process restart.

For more information on syslog for JunOS or the Juniper Networks SRX-series, see the Configuring DSMs Guide.

For more information on viewing PCAP data in STRM, see the STRM

Administration Guide.

Log Source Users Guide

Grouping Log Sources

Grouping Log

Sources

You can view log sources based on functionality. Categorizing your log sources into groups allows you to efficiently view and track your log sources. For example, you can view all log sources by name. Each group can display a maximum of

1,000 log sources.

You must have administrative access to create, edit, or delete groups. For more information on user roles, see the STRM Administration Guide.

This section provides information on the following:

•

Viewing Log Sources Using Groups

•

Creating a Group

•

Editing a Group

•

Copying a Log Source to Another Group

•

Removing a Log Source From a Group

Viewing Log Sources

Using Groups

To view log sources using groups, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Sources icon.

The Log Sources window is displayed.

Step 4

From the Search For drop-down list box, select the group option to display.

Step 5

Select your group criteria.

Step 6

Click Go.

The group results are displayed.

Creating a Group

To create a group, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

The Data Sources pane is displayed.

Step 3

Click the Log Source Groups icon.

Step 4

The Log Source Groups window is displayed.

From the menu tree, select the group under which you want to create a new group.

NOTE

Alternatively, click Assign to access the log source group menu option.

Step 5

Click New Group.

Log Source Users Guide

ANAGING

OURCES

Step 6

The Group Properties window is displayed.

Define values for the parameters:

•

Name - Type a name to assign to the new group. The name can be up to 255 characters in length and is case sensitive.

•

Description - Type a description to assign to this group. The description can be up to 255 characters in length.

Step 7

Click OK.

Step 8

To change the location of the new group, click the new group and drag the folder to a chosen location in your menu tree.

Step 9

Close the Groups Properties window.

NOTE

When you create the group, you can drag and drop menu tree items to change the organization of the tree items.

Editing a Group

To edit a group, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

The Data Sources pane is displayed.

Step 3

Click the Log Source Groups icon.

Step 4

The Log Source Groups window is displayed.

From the menu tree, select the group to edit.

Step 5

Click Edit.

Step 6

The Group Properties window is displayed.

Update values for the parameters, as necessary:

•

Name - Type a name to assign to the new group. The name can be up to 255 characters in length and is case sensitive.

•

Description - Type a description to assign to this group. The description can be up to 255 characters in length.

Step 7

Click OK.

Step 8

To change the location of the group, click the new group and drag the folder to the desired location in your menu tree.

Step 9

Close the Groups window.

Copying a Log

Source to Another

Group

Using the groups functionality, you can copy a log source to one or more groups.

To copy a log source:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Log Source Users Guide

Defining Log Source Parsing Order

Step 3

The Data Sources pane is displayed.

Click the Log Source Groups icon.

Step 4

The Log Source Groups window is displayed.

From the Log Source Groups tree, select the group from which you want to copy the log source.

A list of log sources is displayed in the Group Content Frame.

Step 5

From the Group Content Frame, select the log source you want to copy to another group.

Step 6

Click Copy.

Step 7

The Choose Group window is displayed.

Select the group to which you want to copy the log source.

Step 8

Click Assign Groups.

Step 9

Close the Groups window.

Removing a Log

Source From a Group

Removing a log source group does not delete the log source from STRM, just removes the group association. To remove a log source from a group:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Source Groups icon.

The Log Source Groups window is displayed.

Step 4

From the menu tree, select the a group with items to be removed.

Step 5

From the Group Content Frame, select the item to remove.

Step 6

Click Remove.

A confirmation window is displayed.

Step 7

Click OK.

Step 8

Close the Groups window.

Defining Log

Source Parsing

Order

You can configure the order that you want each Event Collector in your deployment to parse events from log sources (Device Support Modules (DSMs)). If a DSM has multiple incoming log sources under the same IP address or host name, you can order the importance of these incoming log sources by defining the parsing order.

Defining the parsing order for log sources ensures that the required log sources are parsed in a specific order, regardless of changes to the log source configuration. This ensures system performance is not affected by changes to log source configuration by preventing unnecessary parsing.

Log Source Users Guide

ANAGING

OURCES

Step 1

To define the parsing order:

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Source Parsing Ordering icon.

The Log Source Parsing Ordering window is displayed.

NOTE

If no log sources are configured for the selected Event Collector, only the

Selected Event Collector drop-down list box is displayed.

Step 4

Define values for the following parameters:

•

Selected Event Collector - From the drop-down list box, select the Event

Collector to define the log source parsing order.

•

Log Source Host - From the drop-down list box, select which log source host sends events to the Selected Event Collector.

If multiple hosts exist on the Event Collector, a Filter field is displayed. A list of available hosts is displayed in a field below the Filter field. Type the desired host in the Filter field or select from the list below.

Step 5

Define the order of the log source parsing:

Select the desired log source from the table.

Move the log source to the desired order using the available buttons:

Up - Moves the log source higher in the parsing order.

Down - Moves the log source lower in the parsing order.

Top - Moves the log source to the top of the parsing order.

Bottom - Moves the log source to the bottom of the parsing order.

To move a log source to a specific order in the log source parsing list, define the desired order number in the Move to field. Click Go.

Step 6

Click Save.

Step 7

Repeat for all desired log sources.

Log Source Users Guide

2 M

ANAGING

OG

OURCE

XTENSION

Log source extensions allow you to immediately extend the parsing routines of specific devices. For example, you can use a log source extension to detect an event that has missing or incorrect fields. A log source extension can also parse an event when the DSM to which it is attached fails to produce a result.

For information on configuring log sources, see

Managing Log Sources

This section provides information on the following:

•

About Log Source Extensions

•

Creating a Log Source Extension Document

•

Viewing Log Source Extensions

•

Adding a Log Source Extension

•

Editing a Log Source Extension

•

Copying a Log Source Extension

•

Deleting a Log Source Extension

•

Enabling/Disabling a Log Source Extension

•

Reporting a Log Source Extension

About Log Source

Extensions

A log source extension allows a DSM to parse logs even if the DSM has not received an update or if the DSM does not exist for this log source type.

Information about log source extensions is accessed from the Admin tab.

You can also create log source extension reports that can be sent to Customer

Support. This capability is a mechanism for reporting parsing issues and potential fixes to our Customer Support department, so that they can be evaluated for inclusion in future DSM updates.

Creating a Log

Source Extension

Document

Before defining a log source extension within STRM, you must create the extension document. The extension document is an XML document that you create or edit using any common word processing application. Multiple extension documents can be created, uploaded, and associated to various log source types.

Log Source Users Guide

ANAGING

OURCE

XTENSION

The format of the extension document must conform to a standard XML schema document (XSD). To develop an extension document, knowledge of and experience with XML coding is required.

For more information on creating an extensions document, see

Creating an

Extensions Document

The name of the extension document must be in the following format:

<filename>.xml

When you select an extension document for uploading, STRM validates the document against the internal XSD. STRM also verifies the validity of the document before uploading to the system. The following is an example of a valid log source extension document:

<?xml version="1.0" encoding="UTF-8" ?>

<device-extension xmlns="event_parsing/device_extension">

<pattern id="EventName" xmlns=""><![CDATA[

%FWSM[a-zA-Z\-]*\d-(\d{1,6}) ]]></pattern>

<pattern id="SourceIp" xmlns=""><![CDATA[gaddr

(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>

<pattern id="EventNameId" xmlns=""><![CDATA[(\d{1,6})]]></pattern>

<match-group order="1" description="FWSM Test" device-type-id-override="6" xmlns="">

<matcher field="EventName" order="1" pattern-id="EventName" capture-group="1" enable-substitutions="false" />

<matcher field="SourceIp" order="1" pattern-id="SourceIp" capture-group="1" />

<event-match-multiple pattern-id="EventNameId" capture-group-index="1" device-event-category="Cisco Firewall" severity="7" send-identity="OverrideAndNeverSend" />

</match-group>

</device-extension>

NOTE

All characters between the start tag <pattern> and end tag </pattern> are considered part of the pattern. Do not use extra spaces and hard returns inside or around your pattern or <CDATA> expression. Extra characters or spaces can prevent the DSM extension from matching your intended pattern.

Log Source Users Guide

Viewing Log Source Extensions

Viewing Log

Source Extensions

A list of log source extensions, their status and description is displayed in the Log

Source Extensions window.

To view configured log source extensions, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Source Extensions icon.

The Log Source Extensions window provides the following details for each log source extension:

Table 2-1 Log Source Extension Parameters

Parameter

Extension Name

Description

Enabled

Default for Log Source

Types

Description

The name of the log source extension.

After you have added a log source extension, click

Extension Name to download the xml file associated with the parsing override or enhancement.

The description for the log source extension. The description must not exceed 255 characters.

Specifies if the log source extension is enabled (true) or disabled (false).

The log source types the log source extension is overriding or enhancing.

A single log source extension file can be applied to several log sources. The parsing of all the log sources listed are being enhanced or have parsing overrides applied.

Adding a Log

Source Extension

To add a log source extension:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

The Data Sources pane is displayed.

Step 3

Click the Log Source Extensions icon.

Step 4

The Log Source Extension window is displayed.

Click Add.

The Add a Log Source Extension window is displayed.

Step 5

Configure values for the following parameters:

Log Source Users Guide

ANAGING

OURCE

XTENSION

Table 2-2 Add a Log Source Extension Parameters

Parameter

Name

Description

Type a name for the log source extension. The name can be a maximum of 255 alphanumeric characters including an underscore

(_).

Description Type a description for the log source extension. The description can be a maximum of 255 characters.

Use Condition From the drop-down list box, select one of the following:

Log Source

Types

•

Parsing Enhancement - Select this option when the DSM correctly parses most fields for the log source, but needs either one or two fields corrected. The incorrectly parsed field values are enhanced with the new XML values. This is the default setting.

Parsing Override - Select this option when the DSM is unable to parse correctly or is unable to retrieve specific required device information. The log source extension completely overrides the failed parsing by the DSM and substitutes the parsing with the new XML values.

•

Select log sources to add or remove from the extension parsing.

The options include:

Available - Select a log source type and click the right arrow to add the log source to the Set to default for list.

•

Set to default for - Select a log source type and click the left arrow to remove a log source type from the Set to default for list.

Repeat this step for each log source type you want the extension to override or enhance.

Step 6

From the Upload Extension field, click Browse and locate a log source extension document (<filename>.xml) to be uploaded.

Step 7

Click Upload.

The contents of the extension file is displayed. This displayed content is not editable.

Step 8

Click Save.

The new log source extension is created. The Event Collector automatically detects changes and enforces the revised log source extension.

By default, new log source extensions are enabled. If you want to disable the log

source extension, see

Enabling/Disabling a Log Source Extension

If you want to report the log source extension document back to Customer

Support, see

Reporting a Log Source Extension

Log Source Users Guide

Editing a Log Source Extension

Editing a Log

Source Extension

This section provides information on how to edit a log source extension, such as modifying the definition of a log source extension or changing the device to which it is the default log source extension.

Step 1

To edit a log source extension, perform the following steps:

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Source Extensions icon.

The Log Source Extension window is displayed.

Step 4

From the list of log source extensions, select the log source extension that you want to edit.

Step 5

Click Edit.

Step 6

The Edit a Log Source Extension window is displayed.

Edit your extension parameters, as necessary:

Table 2-3 Edit Log Source Extension Parameters

Parameter

Name

Description

Type the name for the log source extension. The name can be a maximum of 255 alphanumeric characters plus the underscore (_).

Description Type the description for the log source extension. The description can be a maximum of 255 characters.

Use Condition From the drop-down list box, select one of the following:

Log Source

Types

•

Select log sources to add or remove from the extension parsing.

The options include:

Available - Select a log source type and click the right arrow to add the log source to the Set to default for list.

•

Set to default for - Select a log source type and click the left arrow to remove a log source type from the Set to default for list.

Repeat this step for each log source type you want the extension to override or enhance.

Log Source Users Guide

ANAGING

OURCE

XTENSION

Step 7

Click Browse and locate a log source extension document (<filename>.xml) if you want to upload an extension document to replace the existing extension document.

Step 8

Click Upload.

Step 9

Click Save.

The log source extension is revised. The Event Collector automatically detects changes and enforces the revised log source extension.

Copying a Log

Source Extension

This section provides information on how to copy a log source extension. Use this function if you want to create a new log source extension that has some or all of the parameters of an existing log source extension. You can use an existing log source extension as a template.

Step 1

To copy a log source extension:

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Source Extensions icon.

Step 4

The Log Source Extension window is displayed.

From the list of log source extensions, select the log source extension that you want to copy.

Step 5

Click Copy.

Step 6

The Add a Log Source Extension window is displayed.

Type values for the parameters:

Table 2-4 Copy Log Source Extension Parameters

Parameter

Name

Description

Type a name for the log source extension. The name can be a maximum of 255 alphanumeric characters plus the underscore (_).

Description Type a description for the log source extension. The description can be a maximum of 255 characters.

Use Condition From the drop-down list box, select one of the following:

•

Log Source Users Guide

Deleting a Log Source Extension

Table 2-4 Copy Log Source Extension Parameters (continued)

Parameter

Log Source

Types

•

Description

Select log sources to add or remove from the extension parsing.

The options include:

Available - Select a log source type and click the right arrow to add the log source to the Set to default for list.

Set to default for - Select a log source type and click the left arrow to remove a log source type from the Set to default for list.

Repeat this step for each log source type you want the extension to override or enhance.

Step 7

Click Save.

The new log source extension is created. The Event Collector automatically detects changes and picks up a new or revised log source extension.

Deleting a Log

Source Extension

Deleting a log source extension removes any additional parsing enhancements or overrides from the log source. If you delete a log source extension, the parsing changes are applied immediately to the incoming events for the log sources impacted by the parsing change.

Step 1

To delete a log source extension, perform the following steps:

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Source Extensions icon.

Step 4

The Log Source Extension window is displayed.

From the list of log source extensions, select the log source extension that you want to delete.

Step 5

Click Delete.

Step 6

A confirmation window is displayed.

Click Yes to confirm the deletion.

Enabling/Disabling a Log Source

Extension

You can enable an existing log source extension or disable an existing log source extension (without deleting the extension). This section provides information on how to enable and disable a log source extension.

To enable or disable a log source extension, perform the following steps:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

The Data Sources pane is displayed.

Log Source Users Guide

ANAGING

OURCE

XTENSION

Step 3

Click the Log Source Extensions icon.

Step 4

The Log Source Extension window is displayed.

From the list of log source extensions, select the log source extension that you want to enable or disable.

Step 5

Click Enable/Disable.

The status (true or false) is displayed in the Enabled column.

The log source extension is enabled or disabled. The Event Collector automatically detects changes and enforces the revised log source extension.

Reporting a Log

Source Extension

After you create a log source extension, you have the option of sending information about that log source extension to Juniper Networks Customer

Support. Sending this information to Juniper Networks Customer Support facilitates the process of providing you with support.

To send a report of the log source extension to Juniper Networks Customer

Support:

Step 1

Click the Admin tab.

Step 2

On the navigation menu, click Data Sources.

Step 3

The Data Sources pane is displayed.

Click the Log Source Extensions icon.

Step 4

From the list of log source extensions, select the log source extension that you want to send to Juniper Networks Customer Support.

Step 5

Click Report.

The Report Log Source Extensions menu is displayed with the extension document in the Extension Document field.

Step 6

Type values for the parameters:

Table 2-5 Reporting a Log Source Extension Parameters

Parameter

Customer Name

Description

Type your company or organization name.

Technical Contact Name Type the name of the technical contact.

Comments Type any comments that can be useful in understanding the issue.

Step 7

Click Send.

Log Source Users Guide

A C

REATING AN

XTENSIONS

OCUMENT

Log source extensions allow you to repair an event with missing or incorrect information. You can also use log source extensions to parse an event when the associated DSM fails to produce a result. Any new events produced by the log source extensions are associated to the device that failed to parse the original payload. Creating an extension prevents unknown or uncategorized events from being stored as unknown in STRM.

NOTE

This document assumes an advanced knowledge of Java-based regular expressions and XML coding.

For more information on configuring log source extensions, see

Managing Log

Source Extension

Before you define a log source extension, you must build an extension document.

This section provides information on the following:

•

About Extension Documents

•

Understanding Extension Document Elements

•

Creating Extension Documents

•

Log Source Type IDs

About Extension

Documents

An extension document is specified in Extensible Markup Language (XML) format and can be created or edited using any common word processing application. You can create multiple extension documents and associate an extension document to various log source types.

Using XML format requires that all regular expressions be contained in character data (CDATA) sections to prevent the special characters required by regular expressions from interfering with the markup format. For example:

<pattern id="Protocol" case-insensitive="true" xmlns="">

<![CDATA[(tcp|udp|icmp|gre)]]></pattern>

Where (tcp|udp|icmp|gre) is the actual regular expression pattern.

Log Source Users Guide

The configuration consists of two sections: patterns and match groups. For more information, see

Understanding Extension Document Elements

Understanding

Extension

Document

Elements

This section explains the two main divisions of the extension document:

•

Patterns

•

Match Groups

Patterns

Rather than associating a regular expression directly with a particular field name, patterns (patterns) are declared separately at the top of the extension document and can be subsequently referenced multiple times within the file.

NOTE

Table A-1 Pattern Parameters

Parameter id

(Required)

case-insensitive

(Optional)

trim-whitespace

(Optional)

Description

Type a regular string that is unique within the extension document.

Type a pattern to ignore character case when doing a match, for example abc is the same as ABC.

If not specified, this parameter defaults to false.

Type if you want the pattern to ignore white space and carriage returns. If the CDATA sections are split onto different lines, this parameter ensures that any extra spaces and carriage returns are not interpreted as part of the pattern.

If not specified, this parameter defaults to false.

Match Groups

A match group (match-group) is a set of patterns used for parsing or modifying one or more types of events. A matcher is an entity within a match group that is parsed (for example, EventName) and is paired with the appropriate pattern and group for parsing. Any number of match groups can appear in the extension document.

Table A-2 Match Group Parameters

Parameter order

(Required)

Description

Type an integer greater than zero to define the order in which the match groups are executed. It must be unique within the extension document.

Log Source Users Guide

Understanding Extension Document Elements

Table A-2 Match Group Parameters (continued)

Parameter description

(Optional)

device-typeid-override

(Optional)

Description

Type a description for the match group, which can be any string.

This information can appear in the logs.

If not specified, this parameter defaults to empty.

Define a different device ID to override the QID. Allows the particular match group to search in the specified device for the event type. It must be a valid log source type ID, represented as an integer. A list of log source type IDs is presented in

Table A-6

If not specified, this parameter defaults to the log source type of the log source to which the extension is attached.

Match groups can have up to three different types of entities:

•

Matcher (matcher)

•

Single-Event Modifier (event-match-single)

•

Multi-Event Modifier (event-match-multiple)

Matcher (matcher)

A matcher entity is a field that is parsed (for example, EventName) and is paired with the appropriate pattern and group for parsing. Matchers have an associated order, so if multiple matchers are specified for the same field name, the matchers are executed in the order presented until a successful parse is found or a failure occurs.

Table A-3 Matcher Entity Parameters

Parameter field

(Required)

pattern-id

(Required)

order

(Required)

Description

Type the field to which you want the pattern to apply, for example, EventName, or SourceIp. See

Table A-4

for a

list of valid field names.

Type the pattern you want to use when parsing the field out of the payload. This value must match (including case) the ID parameter of the pattern previously defined in a pattern ID parameter (

Table A-1

Type the order that you want this pattern to attempt among matchers assigned to the same field. If there are two matchers assigned to the EventName field, the one with the lowest order is attempted first.

Log Source Users Guide

Table A-3 Matcher Entity Parameters (continued)

Parameter capture-group

(Optional)

enable-substitutions

(Optional)

ext-data

(Optional)

Description

Define a capture group, as denoted in the regular expression inside parenthesis ( ). These captures are indexed starting at one and processed from left to right in the pattern. The capture-group field must be a positive integer less than or equal to the number of capture groups contained in the pattern. The default value is zero, which is the entire match.

For example, you can define a single pattern for a source IP address and port; where the SourceIp matcher can use a capture group of 1, and the SourcePort matcher can use a capture group of 2, but only one pattern needs to be defined.

This field has a dual purpose when combined with the

enable-substitutions

parameter.

Type this Boolean parameter as true when a field cannot be adequately represented with a straight group capture. Allows you to combine multiple groups together with extra text to form a value.

This parameter changes the meaning of the

capture-group

parameter. The capture-group parameter creates the new value, and group substitutions are specified using \x where x is a group number from 1 to 9. You can use groups multiple times, and any free-form text can also be inserted into the value. For example, if you need to form a value out of group 1, followed by an underscore, followed by group 2, an @, and then group 1 again, the appropriate capture-group syntax is:

capture-group=”\1_\2@\1”

In another example, a MAC address is separated by colons, but STRM assumes that MAC addresses are hyphen separated. The syntax to parse and capture the individual portions is:

capture-group=”\1:\2:\3:\4:\5:\6”

If no groups are specified in the capture-group when substitutions are enabled, a direct text replacement occurs.

Default is false.

Type an extra-data parameter to define any extra field information or formatting that a Matcher Field can provide in the extension.

For example, you might have a device that sends events using a unique timestamp, but you want the event to be reformatted to a standard device time. The ext-data parameter included with the DeviceTime field allows you to reformat the date and timestamp of the event. For

more information, see

Table A-4

Log Source Users Guide

Understanding Extension Document Elements

Table A-4

provides a list of valid field names for use in the matcher field parameter

(see

Table A-2

Table A-4 Matcher Field Names

Field Name

EventName

(Required)

EventCategory

Description

Type the event name to be retrieved from the QID to identify the event.

Type an event category for any event with a category not handled by an event-match-single entity or an

event-match-multiple

entity.

Combined with EventName, EventCategory is used to search for the event in the QID.

SourceIp

SourcePort

SourceIpPreNAT

SourceIpPostNAT

SourceMAC

SourcePortPreNAT

SourcePortPostNAT

DestinationIp

Type the source IP address for the message.

Type the source port for the message.

Type the source IP address for the message before

Network Address Translation (NAT) occurs.

Type the source IP address for the message after NAT occurs.

Type the source MAC address for the message.

Type the source port for the message before NAT occurs.

Type the source port for the message after NAT occurs.

Type the destination IP address for the message.

DestinationPort

DestinationIpPreNAT

Type the destination port for the message.

Type the destination IP address for the message before

NAT occurs.

DestinationIpPostNAT Type the destination IP address for the message after NAT occurs.

DestinationPortPreNAT Type the destination port for the message before NAT occurs.

DestinationPortPostNAT Type the destination port for the message after NAT occurs.

DestinationMAC Type the destination MAC address for the message.

Log Source Users Guide

Table A-4 Matcher Field Names (continued)

Field Name

DeviceTime

Protocol

UserName

HostName

GroupName

NetBIOSName

ExtraIdentityData

SourceIpv6

DestinationIpv6

Description

Type the time and format used by the device. This date and timestamp represents the time that the event was sent, according to the device (this is NOT the time that the event arrived). The DeviceTime field supports the ability to use a custom date and timestamp for the event by calling the ext-data Matcher Entity.

The following list contains examples of date and timestamp formats that can be used in the DeviceTime field:

•

• ext-data="dd/MMM/YYYY:hh:mm:ss" ext-data="MMM dd YYYY / hh:mm:ss"

• ext-data="hh:mm:ss:dd/MMM/YYYY"

For more information on the possible values for the data and timestamp format, see http://download.oracle.com/javase/1.4.2/docs/api/java/text/

SimpleDateFormat.html.

Note: DeviceTime is the only event field that uses the ext-data optional parameter.

Type the protocol associated with the event; for example,

TCP, UDP, or ICMP.

If a protocol is not properly parsed out of a message, ports that were parsed can not appear in STRM (it only displays ports for port-based protocols).

Type the username associated with the event.

Type the host name associated with the event. Typically, this field is associated with identity events.

Type the group name associated with the event. Typically, this field is associated with identity events.

Type the NetBIOS name associated with the event.

Typically, this field is associated with identity events.

Type any user-specific data associated with the event.

Typically, this field is associated with identity events.

Type the IPv6 source IP address for the message.

Type the IPv6 destination IP address for the message.

Single-Event Modifier (event-match-single)

Single-event modifier (event-match-single) matches (and subsequently modifies) exactly one type of event, as specified by the required, case-sensitive

EventName parameter. This entity allows mutation of successful events by changing the device event category, severity, or the method for sending identity events.

Log Source Users Guide

Understanding Extension Document Elements

When events matching this event name are parsed, the device category, severity, and identity properties are imposed upon the resulting event. An event-match-single entity consists of three optional properties:

Table A-5 Single-Event Modifier Parameters

Parameter Description device-event-category

Type a new category for searching in the QID for the event. This is an optimizing parameter, since some devices have the same category for all events.

severity

Type the severity of the event. This parameter must be an integer value between 1 and 10.

If a severity of less than 1 or greater than 10 is specified, the system defaults to 5.

If not specified, the default is whatever is found in the

QID.

send-identity

•

Specifies the sending of identity change information from the event. Choose one of the following options:

UseDSMResults

– If the DSM returns an identity event, the event is passed on. If the DSM does not return an identity event, the DSM does not create or modify the identity information.

This is the default value if no value is specified.

•

SendIfAbsent

– If the DSM creates identity information, the identity event is passed through unaffected. If no identity event is produced by the

DSM, but there is enough information in the event to create an identity event, an event is generated with all the relevant fields set.

OverrideAndAlwaysSend

– Ignores any identity event returned by the DSM and creates a new identity event, if there is enough information.

OverrideAndNeverSend

– Suppress any identity information returned by the DSM.

Multi-Event Modifier (event-match-multiple)

The multi-event modifier (event-match-multiple) matches a range of event types (and subsequently modifies) as specified by the pattern-id parameter and the capture-group-index parameter.

NOTE

This match is not performed against the payload, but is performed against the results of the EventName matcher previously parsed out of the payload.

This entity allows mutation of successful events by changing the device event category, severity, or the method the event uses to send identity events. The

capture-group-index

must be an integer value (substitutions are not

Log Source Users Guide

supported) and pattern-ID must reference an existing pattern entity. All other properties are identical to their counterparts in the single-event modifier

Creating Extension

Documents

This section provides information on the following:

•

Writing a Complete Extension Document

•

Uploading Extension Documents

•

Solving Specific Parsing Issues

Writing a Complete

Extension Document

The example of an extension document included in this section provides information on how to parse one particular type of Cisco FWSM so that events are not sent with an incorrect event name. For example, if you want to resolve the word session, which is embedded in the middle of the event name:

Nov 17 09:28:26 129.15.126.6 %FWSM-session-0-302015: Built UDP connection for faddr 38.116.157.195/80 gaddr

129.15.127.254/31696 laddr 10.194.2.196/2157 duration 0:00:00 bytes 57498 (TCP FINs)

This condition causes the DSM to not recognize any events and all the events are un-parsed and associated with the generic logger.

Although only a portion of the text string (302015) is used for the QID search, the entire text string (%FWSM-session-0-302015) identifies the event as coming from a Cisco FWSM. Since the entire text string is invalid, the DSM assumes that the event is invalid.

An FWSM device has a large number of event types, many with unique formats.

The following extension document example indicates how to parse one event type.

NOTE

The pattern IDs do not have to match the field names that they are parsing. Even though the following example duplicates the pattern, the SourceIp field and the

SourceIpPreNAT field could use the exact same pattern in this case (this might not be true in all FWSM events).

<?xml version="1.0" encoding="UTF-8"?>

<device-extension xmlns="event_parsing/device_extension">

<pattern id="EventNameFWSM" xmlns=""><![CDATA[%FWSM[a-zA-Z\-]*\d-(\d{1,6})]]></pattern>

<pattern id="SourceIp" xmlns=""><![CDATA[gaddr

(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>

<pattern id="SourceIpPreNAT" xmlns=""><![CDATA[gaddr

(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>

<pattern id="SourceIpPostNAT" xmlns=""><![CDATA[laddr

(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>

<pattern id="DestinationIp" xmlns=""><![CDATA[faddr

Log Source Users Guide

Creating Extension Documents

(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/([\d]{1,5})]]></pattern>

<pattern id="Protocol" case-insensitive="true" xmlns=""><![CDATA[(tcp|udp|icmp|gre)]]></pattern>

<pattern id="Protocol_6" case-insensitive="true" xmlns=""><![CDATA[ protocol=6]]></pattern>

<pattern id="EventNameId" xmlns=""><![CDATA[(\d{1,6})]]></pattern>

<match-group order="1" description="FWSM Test" device-type-id-override="6" xmlns="">

<matcher field="EventName" order="1" pattern-id="EventNameFWSM" capture-group="1"/>

<matcher field="SourceIp" order="1" pattern-id="SourceIp" capture-group="1" />

<matcher field="SourcePort" order="1" pattern-id="SourceIp" capture-group="2" />

<matcher field="SourceIpPreNAT" order="1" pattern-id="SourceIpPreNAT" capture-group="1" />

<matcher field="SourceIpPostNAT" order="1" pattern-id="SourceIpPostNAT" capture-group="1" />

<matcher field="SourcePortPreNAT" order="1" pattern-id="SourceIpPreNAT" capture-group="2" />

<matcher field="SourcePortPostNAT" order="1" pattern-id="SourceIpPostNAT" capture-group="2" />

<matcher field="DestinationIp" order="1" pattern-id="DestinationIp" capture-group="1" />

<matcher field="DestinationPort" order="1" pattern-id="DestinationIp" capture-group="2" />

<matcher field="Protocol" order="1" pattern-id="Protocol" capture-group="1" />

<matcher field="Protocol" order="2" pattern-id="Protocol_6" capture-group="TCP" enable-substitutions=”true”/>

<event-match-multiple pattern-id="EventNameId" capture-group-index="1" device-event-category="Cisco

Firewall"/>

</match-group>

</device-extension>

The above extension document example demonstrates some of the basic aspects of parsing:

•

IP addresses

•

Ports

• Protocol

• Multiple fields using the same pattern with different groups

Log Source Users Guide

This example parses all FWSM events that follow the specified pattern, although the fields that are parsed might not be present in those events (if the events include different content).

The information that was necessary to create this configuration that was not available from the event:

• The event name is only the last six digits (302015) of the

%FWSM-session-0-302015

portion of the event.

• The FWSM has a hard-coded log source type category of Cisco Firewall.

• The FWSM uses the Cisco Pix QID and therefore includes the

device-type-id-override="6"

parameter in the match group (the Pix

firewall’s log source type ID is 6, see

Table A-6

NOTE

If the QID information is not specified or is unavailable, you can modify the event mapping. For more information, see the Modifying Event Mapping section in the

STRM Users Guide.

An event name and a device event category is required when looking for the event in the QID. This device event category is a grouping parameter within the database that helps define like events within a device. The event-match-multiple at the end of the match group includes hard-coding of the category. The

event-match-multiple

uses the EventNameId pattern on the parsed event name to match up to six digits. This pattern is not run against the full payload, just that portion parsed as the EventName field.

The EventName pattern references the %FWSM portion of the events; all Cisco

FWSM events contain the %FWSM portion. The pattern in the example matches

%FWSM

followed by any number (zero or more) of letters and dashes. This pattern match resolves the word session that is embedded in the middle of the event name that needs to removed. The event severity (according to Cisco), followed by a dash and then the true event name as expected by STRM. The only string with a capture group (that is, bounded by parenthesis) is this pattern of digits

(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})

The IP addresses and ports for the event all follow the same basic pattern: an IP address followed by a slash followed by the numeric port number. This pattern parses two pieces of data (the IP address and the port), and specifies different capture groups in the matcher section.

<matcher field="SourceIp" order="1" pattern-id="SourceIp" capture-group="1" />

<matcher field="SourcePort" order="1" pattern-id="SourceIp" capture-group="2" />

Thus, the IP address/port patterns are four sets of one to three digits, separated by periods followed by a slash and the port number. The IP address section is in a group, as is the port number (but not the slash). As was previously mentioned, the

Log Source Users Guide

Creating Extension Documents

matcher sections for these fields reference the same pattern name, but a different capture group (the IP address is group 1 and the port is group 2).

The protocol is a common pattern that searches the payload for the first instance of

TCP, UDP, ICMP, or GRE (the pattern is marked with the case-insensitive parameter so that any occurrence matches).

NOTE

You must search for the protocol when writing extension documents, as STRM might not display port numbers if the event is not based on a port-based protocol.

See

Converting a Protocol

for an example of how to search for a protocol.

Although a second protocol pattern does not occur in the event being used as an example, there is a second protocol pattern defined with an order of two. If the lowest-ordered protocol pattern does not match, the next one is attempted (and so on). The second protocol pattern also demonstrates the cpt of a direct substitution; there are no match groups in the pattern, but with the enable-substitutions parameter enabled, the text TCP can be used in place of protocol=6.

Uploading Extension

Documents

Multiple extension documents can be created, uploaded, and associated to various log source types. Extension documents can be stored anywhere prior to uploading to STRM. When you select an extension document for uploading, STRM validates the document against the internal XSD. STRM also verifies the validity of the document before uploading to the system.

Solving Specific

Parsing Issues

This section provides you with XML examples that can be used when resolving specific parsing issues.

•

Converting a Protocol

•

Making a Single Substitution

•

Generating a Colon-Separated MAC Address

•

Combining IP Address and Port

•

Modifying an Event Category

•

Modifying Multiple Event Categories

•

Suppressing Identity Change Events

•

Encoding Logs

Converting a Protocol

The following example shows a typical protocol conversion that searches for TCP,

UDP, ICMP, or GRE anywhere in the payload, surrounded by any word boundary

(for example, tab, space, end-of-line). Also, character case is ignored:

<pattern id="Protocol" case-insensitive="true" xmlns=""><![CDATA[\b(tcp|udp|icmp|gre)\b]]> </pattern>

Log Source Users Guide

<matcher field="Protocol" order="1" pattern-id="Protocol" capture-group="1" />

Making a Single Substitution

The following is an example of a straight substitution that parses the source IP address, and then overrides the result and sets the IP address to 10.100.100.100, ignoring the IP address in the payload. This example assumes that the source IP address matches something similar to SrcAddress=10.3.111.33 followed by a comma:

<pattern id="SourceIp_AuthenOK" xmlns="">

<![CDATA[SrcAddress=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}),]]></p attern

<matcher field="SourceIp" order="1" pattern-id="SourceIp_AuthenOK" capture-group="100.100.100.100" enable-substitutions="true"/>

Generating a Colon-Separated MAC Address

STRM detects MAC addresses in a colon-separated form. Since all devices do not use this form, the following example shows how to correct that situation:

<pattern id="SourceMACWithDashes" xmlns=""><![CDATA[SourceMAC=([0-9a-fA-F]{2})-([0-9a-fA-F]{2})-(

[0-9a-fA-F]{2})-([0-9a-fA-F]{2})-([0-9a-fA-F]{2})-([0-9a-fA-F]{

2})]]></pattern>

<matcher field="SourceMAC" order="1" pattern-id="

SourceMACWithDashes" capture-group="\1:\2:\3:\4:\5:\6" />

In the above example SourceMAC=12-34-56-78-90-AB is converted to a MAC address of 12:34:56:78:90:AB.

If the dashes are removed from the pattern, the pattern converts a MAC address with no separators. If spaces are inserted, the pattern converts a space-separated

MAC address, and so on.

Combining IP Address and Port

Typically an IP address and port are combined in one field, separated by a colon or a slash. The following example uses multiple capture groups with one pattern:

pattern id="SourceIPColonPort" xmlns=""><!

[CDATA[Source=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):([\d]{1,5})]

]></pattern>

<matcher field="SourceIp" order="1" pattern-id="SourceIPColonPort" capture-group="1" />

<matcher field="SourcePort" order="1" pattern-id="SourceIPColonPort" capture-group="2" />

Log Source Users Guide

Creating Extension Documents

Modifying an Event Category

A device event category can be hard-coded, or the severity needs to be adjusted.

The following example adjusts the severity for a single event type:

<event-match-single event-name="TheEvent" device-event-category="Actual Category" severity="6" send-identity="UseDSMResults" />

Modifying Multiple Event Categories

The following example is similar to the above single event example, except that this example matches all event codes starting with 7 and followed by one to five digits:

<pattern id="EventNameId" xmlns=""><![CDATA[(7\d{1,5})]]></pattern>

<event-match-multiple pattern-id="EventNameId" capture-group-index="1" device-event-category="Actual Category" severity="6" send-identity="UseDSMResults"/>

Suppressing Identity Change Events

A DSM might unnecessarily send identity change events. The following are two examples; one is a method of how to suppress identity change events from being sent from a single event type. The other is a method of how to suppress identity change events from being sent from a group of events.

// Never send identity for the event with an EventName of

“Authen OK”

<event-match-single event-name="Authen OK" device-event-category="ACS" severity="6" send-identity="OverrideAndNeverSend" />

// Never send any identity for an event with an event name starting with 7, followed by one to five other digits:

<pattern id="EventNameId" xmlns=""><![CDATA[(7\d{1,5})]]></pattern>

<event-match-multiple pattern-id="EventNameId" capture-group-index="1" device-event-category="Cisco Firewall" severity="7" send-identity="OverrideAndNeverSend"/>

Encoding Logs

The following encoding formats are supported:

•

US-ASCII

•

UTF-8

Logs can be forwarded to the system in an encoding that does not match

US-ASCII or UTF-8 formats. You can configure an advanced flag to ensure input can be re-encoded to UTF-8 for parsing and storage purposes.

Log Source Users Guide

For example, if you want to ensure that the source logs arrive in SHIFT-JIS

(ANSI/OEM Japanese) encoding, type the following:

<device-extension source-encoding=”SHIFT-JIS” xmlns=”event_parsing/device_extension”>

The logs are enclosed in UTF-8 format.

Formatting Event Dates and Timestamps

A STRM log source extensions can detect several different date and timestamp formats on events. Since device manufacturers do not conform to a standard date and timestamp format, the ext-data optional parameter is included in the log source extension to allow the DeviceTime to be reformatted. The following example shows how an event can be reformatted to correct the date and timestamp formatting:

<device-extension>

<pattern id="EventName1">(logger):</pattern>

<pattern id="DeviceTime1">time=\[(\d{2}/\w{3}/\d{4}:\d{2}:\d{2}:\d{2})\]

</pattern>

<pattern id="Username">(TLSv1)</pattern>

<match-group order="1" description="Full Test">

<matcher field="EventName" order="1" pattern-id="EventName1" capture-group="1"/>

<matcher field="DeviceTime" order="1" pattern-id="DeviceTime1" capture-group="1" ext-data="dd/MMM/YYYY:hh:mm:ss"/>

<matcher field="UserName" order="1" pattern-id="Username" capture-group="1"/></match-group>

Log Source Users Guide

Log Source Type IDs

Log Source Type

IDs

Table A-6

lists the Log Source Type IDs that can be used in a match-group statement:

Table A-6 Log Source Type ID Numbers

Log Source Type

Snort Open Source IDS

Check Point Firewall-1

Configurable Firewall Filter

Juniper Networks Firewall and VPN

Cisco PIX Firewall

Configurable Authentication message filter

Enterasys Dragon Network IPS

Apache HTTP Server

Linux OS

Microsoft Windows Security Event Log

Windows IIS

Linux iptables Firewall

IBM Proventia Network Intrusion Prevention System (IPS)

Juniper Networks Intrusion Detection and Prevention (IDP)

TippingPoint Intrusion Prevention System (IPS)

Cisco IOS

Nortel Contivity VPN Switch

Nortel Multiprotocol Router

Cisco VPN 3000 Series Cntrator

Solaris Operating System Authentication Messages

McAfee IntruShield Network IPS Appliance

Cisco CSA

Enterasys Matrix E1 Switch

Solaris Operating System Sendmail Logs

Cisco Intrusion Prevention System (IDS)

Cisco Firewall Services Module (FWSM)

IBM Proventia Management SiteProtector

Cyberguard FW/VPN KS Family

Juniper Networks Secure Access (SA) SSL VPN

Nortel Contivity VPN Switch

Top Layer Intrusion Prevention System (IPS)

Universal DSM

Log Source Users Guide

Table A-6 Log Source Type ID Numbers (continued)

100

101

Log Source Type

Tripwire Enterprise

Cisco Adaptive Security Appliance (ASA)

Niksun 2005 v3.5

Juniper Networks Network and Security Manager (NSM)

Squid Web Proxy

Ambiron TrustWave ipAngel Intrusion Prevention System (IPS)

Oracle RDBMS Audit Records

F5 Networks BIG-IP LTM

Solaris Operating System DHCP Logs

Array Networks SSL VPN Access Gateway

Cisco CatOS for Catalyst Switches

ProFTPD Server

Linux DHCP Server

Juniper Networks Infranet Controller

Juniper JunOS Platform

Enterasys Matrix K/N/S Series Switch

Extreme Networks ExtremeWare Operating System (OS)

Sidewinder G2 Security Appliance

Fortinet FortiGate Security Gateway

SonicWall UTM/Firewall/VPN device

Vericept Content 360

Symantec Gateway Security (SGS) Appliance

Juniper Steel Belted Radius

IBM AIX Server

Metainfo MetaIP

SymantecSystemCenter

Cisco ACS

Forescout CounterACT

McAfee ePolicy Orchestrator

CiscoNAC Appliance

TippingPoint X Series Appliances

Microsoft DHCP Server

Microsoft IAS Server

Microsoft Exchange Server

Trend Interscan VirusWall

Microsoft SQL Server

Log Source Users Guide

Log Source Type IDs

Table A-6 Log Source Type ID Numbers (continued)

143

144

145

146

139

140

141

142

134

135

136

138

118

120

122

123

148

149

150

153

154

155

114

115

116

117

110

111

112

113

102

103

104

106

107

108

Log Source Type

MAC OS X

Bluecoat SG Appliance

Nortel Switched Firewall 6000

3Com 8800 Series Switch

Nortel VPN Gateway

Nortel Threat Protection System (TPS) Intrusion Sensor

Nortel Application Switch

Juniper DX Application Acceleration Platform

SNARE Reflector Server

Cisco 12000 Series Routers

Cisco 6500 Series Switches

Cisco 7600 Series Routers

Cisco Carrier Routing System

Cisco Integrated Services Router

Juniper M-Series Multiservice Edge Routing

Nortel Switched Firewall 5100

Juniper MX-Series Ethernet Services Router

Juniper T-Series Core Platform

Nortel Ethernet Routing Switch 8300/8600

Nortel Ethernet Routing Switch 2500/4500/5500

Nortel Secure Router

OpenBSD OS

Juniper Ex-Series Ethernet Switch

Sysmark Power Broker

Oracle Database Listener

Samhain HIDS

Bridgewater Systems AAA Service Controller

Name Value Pair

Nortel Secure Network Access Switch (SNAS)

Starent Networks Home Agent (HA)

IBM AS/400 iSeries

Foundry Fastiron

Juniper SRX-series Services Gateway

CRYPTOCard CRYPTOShield

Imperva Securesphere

Aruba Mobility Controller

Log Source Users Guide

Table A-6 Log Source Type ID Numbers (continued)

185

186

187

188

179

180

182

183

175

176

177

178

171

172

173

174

189

191

192

193

194

195

167

168

169

170

163

164

165

166

156

157

158

159

160

161

Log Source Type

Enterasys NetsightASM

Enterasys HiGuard

Motorola SymbolAP

Enterasys HiPath

Symantec Endpoint Protection

IBM RACF

RSA Authentication Manager

Redback ASE

Trend Micro Office Scan

Enterasys XSR Security Routers

Enterasys Stackable and Standalone Switches

Juniper Networks AVT

OS Services Qidmap

Enterasys A-Series

Enterasys B2-Series

Enterasys B3-Series

Enterasys C2-Series

Enterasys C3-Series

Enterasys D-Series

Enterasys G-Series

Enterasys I-Series

Trend Micro Control Manager

Cisco IronPort

Hewlett Packard UniX

Cisco Aironet

Cisco Wireless Services Module (WiSM)

ISC BIND

IBM Lotus Domino

HP Tandem

Sentrigo Hedgehog

Sybase ASE

Microsoft ISA

Juniper SRC

Radware DefensePro

Cisco ACE Firewall

IBM DB2

Log Source Users Guide

Table A-6 Log Source Type ID Numbers (continued)

231

232

233

234

226

227

228

230

222

223

224

225

218

219

220

221

235

239

240

241

243

244

214

215

216

217

209

210

211

213

196

197

198

199

206

208

Log Source Type

Oracle Audit Vault

Sourcefire Defense Center

Websense V Series

Oracle RDBMS OS Audit Record

Palo Alto PA Series

HP ProCurve

Microsoft Operations Manager

EMC VMWare

IBM WebSphere Application Server

F5 Networks BIG-IP ASM

FireEye

Fair Warning

IBM Informix

CA Top Secret

Enterasys NAC

System Center Operations Manager

McAfee Web Gateway

CA Access Control Facility (ACF2)

McAfee Application / Change Control

Lieberman Random Password Manager

Sophos Enterprise Console

NetApp Data ONTAP

Sophos PureMessage

Cyber-Ark Vault

Itron Smart Meter

Bit9 Parity

IBM IMS

F5 Networks FirePass

Citrix NetScaler

F5 Networks BIG-IP APM

Juniper Networks vGW

Oracle BEA WebLogic

Sophos Web Security Appliance

Sophos Astaro Security Gateway

Infoblox NIOS

Tropos Control

Log Source Users Guide

Log Source Type IDs

Table A-6 Log Source Type ID Numbers (continued)

245

Log Source Type

Novell eDirectory

Log Source Users Guide

B I

NSTALLING

ROTOCOL

OURCES

You can install a protocol source that allows you to access additional or updated protocols for use with your Device Support Modules (DSMs) and log sources.

Step 1

To install a protocol, perform the following steps:

Download the file from the Juniper customer support website to your system hosting STRM.

Step 2

For access to Juniper customer support, contact Customer Support.

Using SSH log in to STRM, as the root user.

Username: root

Step 3

Password: <password>

Navigate to the directory that includes the downloaded file.

Step 4

Type the following command:

rpm -Uvh <filename>

Where <filename> is the name of the downloaded file. For example:

rpm -Uvh PROTOCOL-SNMP-7.0-201509.noarch.rpm

Step 5

Restart the Tomcat service:

service tomcat restart

Step 6

Where <IP Address> is the IP address of the STRM system.

Step 7

Click the Admin tab.

Step 8

Select Advanced > Deploy Full Configuration.

CAUTION

Deploying Full Configuration restarts multiple services on the STRM system.

Event collection is unavailable on STRM until the Deploy Full Configuration completes.

Log Source Users Guide

C DCOM C

ONFIGURATION

The Microsoft Security Event Log and Microsoft Security Event Log Custom protocols provide remote agentless Windows event log collection for Windows server versions 2000, 2003, 2008, Windows XP, Windows Vista, and Windows 7 using the Microsoft Windows Management Instrumentation (WMI) API.

Before You Begin

Before you install the Windows Event Log Protocol, you must configure your system DCOM settings for each host you want to monitor. Ensure the following is configured for each host:

• Configure and enable DCOM on the host.

•

Enable Windows Management Instrumentation on the host.

•

Activate the remote registry service.

• Ensure you have appropriate administrative or user permissions for DCOM and

WMI. For this process, you must be a member of the Administrators group, or you must create a group with the necessary permissions to access the remote computer. If the system is part of a domain, you must be a member of the

Domain Administrators group.

• You have configured any firewalls to permit traffic on TCP port 135, as well as permitting DCOM communications TCP ports above 1024 on your network.

After you have reviewed the Before You Begin section, you can configure your server. Select your server configuration from the options below:

• To Configure DCOM and WMI for Windows Server 2003. For more information,

see

Configuring Windows Server 2003

• To Configure DCOM and WMI for Windows Server 2008. For more information,

see

Configuring Windows Server 2008

Log Source Users Guide

Configuring

Windows Server

2003

To configure DCOM on Windows Server 2003, perform the following steps:

Verify the required Windows Server 2003 services are started. For more information, see

Required DCOM and WMI Services for Windows Server 2003

Enabling DCOM for Windows Server 2003. For more information, see

Enabling

DCOM for Windows Server 2003

Configure DCOM communications for Windows Server 2003. For more information, see

Configuring DCOM Communications in Windows Server 2003

Configure user accounts for DCOM. For more information, see

Windows Server 2003 User Accounts for DCOM

Configure WMI for Windows Server 2003. For more information, see

Enabling DCOM for Windows Server 2003

WMI User Access for Server 2003

Test the WMI configuration. For more information, see

Verifying your WMI

Communications

Required DCOM and

WMI Services for

Windows Server 2003

The following Windows services for DCOM must be started and configured for automatic startup:

• Server

•

Remote Registry

•

Windows Management Instrumentation

To configure the Server and Remote Registry services for automatic startup, you must:

Step 1

On your desktop, select Start > Run.

Step 2

The Run window is displayed.

Type the following:

services.msc

Step 3

Click OK.

Step 4

The Services window is displayed.

In the details pane, verify the following services are started and set to automatic startup:

•

Server

Step 5

• Remote Registry

To change a service property, using the right-mouse button (right-click) on the service name, and then click Properties.

Step 6

Using the Startup type drop-down list box, select Automatic.

Step 7

If the Service status is not started, click Start.

Log Source Users Guide

Configuring Windows Server 2003

Step 8

Click OK.

Step 9

The Services window is displayed.

Close the Services window.

You are now ready to enable DCOM on your Windows Server 2003. For more information, see

Enabling DCOM for

Windows Server 2003

To enable DCOM on your Windows Server 2003 , perform the following steps:

Step 1

On your desktop, select Start > Run.

Step 2

The Run window is displayed.

Type the following:

dcomcnfg

Step 3

Click OK.

Step 4

The Component Services window is displayed.

Under Console root, expand Component Services, expand Computers, and select My Computer.

Step 5

On the Action menu, click Properties.

Step 6

Select the Default Properties tab.

Step 7

Configure the following Default Properties:

Select the Enable Distributed COM on this computer check box.

Using the Default Authentication Level drop-down list box, select Connect.

Using the Default Impersonation Level drop-down list box, select Identify.

NOTE

You can define the TCP ports DCOM uses to communicate on your network by configuring the Properties for Connection-oriented TCP/IP. For more information, see

Configuring DCOM Communications in Windows Server 2003

Step 8

Click Apply, then click OK.

Step 9

The Component Services window is displayed.

Close the Component Services window.

You are now ready to configure DCOM ports on your Windows Server 2003. For more information, see

Configuring DCOM Communications in Windows Server

2003

Configuring DCOM

Communications in

Windows Server 2003

Windows Server 2003 requires TCP/IP communications for DCOM.

To configure DCOM TCP/IP communications, you must:

Step 1

On your desktop, select Start > Run.

The Run window is displayed.

Log Source Users Guide

Step 2

Type the following:

dcomcnfg

Step 3

Click OK.

Step 4

The Component Services window is displayed.

Under Console root, expand Component Services, expand Computers, and select My Computer.

Step 5

On the Action menu, click Properties.

Step 6

Select the Default Protocols tab.

Step 7

Configure the following options:

If Connection-oriented TCP/IP is listed in the DCOM Protocols window, go to

Step 8

If Connection-oriented TC/IP is not listed in the DCOM Protocol window, select

Add. The Select DCOM protocol window is displayed.

From the drop-down list box, select Connection-oriented TC/IP.

Step 8

Click OK.

The My Computer Properties window is displayed.

Step 9

Click OK.

Step 10

The Component Services window is displayed.

Close the Component Services window.

You are now ready to configure a user account with permission to access the host.

For more information, see

Configuring Windows Server 2003 User Accounts for

DCOM

Configuring

Windows Server 2003

User Accounts for

DCOM

you have enabled DCOM, you must assign an account the proper permission to access DCOM on the host. You must select an existing account with administrative access or create a normal user account that is a member of an administrative group to access the host.

To configure a user account for DCOM on Windows Server 2003, perform the following steps:

Step 1

On your desktop, select Start > Run.

Step 2

The Run window is displayed.

Type the following:

dcomcnfg

Step 3

Click OK.

Step 4

The Component Services window is displayed.

Under Console root, expand Component Services, expand Computers, and select My Computer.

Log Source Users Guide

Configuring Windows Server 2003

Step 5

On the Action menu, click Properties.

Step 6

Select the COM Security tab.

Step 7

In Access Permissions, click Edit Default.

The Access Permission window is displayed.

Step 8

Select the user or group requiring DCOM access.

NOTE

If the user or group requiring DCOM access is not listed in the permissions list, you must add the user to the configuration.

Step 9

Select the check boxes for the following permissions:

•

Local Access - Select the Allow check box.

•

Remote Access - Select the Allow check box.

Step 10

Click OK.

Step 11

The My Computer Properties window is displayed.

In Launch and Activation Permissions, click Edit Default.

Step 12

Select the user or group requiring DCOM access.

Step 13

Configure the following permissions:

• Local Launch - Select the Allow check box.

•

Remote Launch - Select the Allow check box.

•

Local Activation - Select the Allow check box.

Step 14

• Remote Activation - Select the Allow check box.

Click OK.

Step 15

The My Computer Properties window is displayed.

Click OK.

Step 16

The Component Services window is displayed.

Close the Component Services window.

You are now ready to configure Windows Management Instrumentation (WMI) on

your Windows Server 2003. For more information, see

Configuring WMI User

Access for Server 2003

Configuring WMI

User Access for

Server 2003

The user or group you configured for DCOM access must also have Windows

Management Instrumentation (WMI) permission to access the Windows event logs required by STRM.

Log Source Users Guide

Step 1

To configure WMI User Access, perform the following steps:

On your desktop, select Start > Run.

The Run window is displayed.

Step 1

Type the following:

wmimgmt.msc

Step 2

Click OK.

Step 3

The Windows Management Infrastructure window is displayed.

Right-click on WMI Control (Local), and then click Properties.

Step 4

The WMI Control (Local) Properties window is displayed.

Click the Security tab.

Step 5

In the Namespace navigation, expand Root.

Step 6

In the menu tree, click CIMV2.

Step 7

Click Security.

The Security for ROOT\COMV2 window is displayed.

Step 8

Select the user or group requiring WMI access.

NOTE

If the user or group requiring WMI access is not listed in the permissions list, you must add the user to the configuration.

Step 9

Configure the following user permissions:

•

Execute Methods - Select the Allow check box.

•

Provider Write - Select the Allow check box.

• Enable Account - Select the Allow check box.

• Remote Enable - Select the Allow check box.

NOTE

If the user or group you are configuring is an Administrator, the allow permission check boxes might already be selected.

Step 10

Click OK.

Step 11

The My Computer Properties window is displayed.

Click OK to close the My Computer Properties window.

You must querying the Windows Server 2003 for event or security logs to complete the DCOM configuration by verify WMI communications. For more information, see

Verifying your WMI Communications

Log Source Users Guide

Configuring Windows Server 2008

Configuring

Windows Server

2008

To configure DCOM on Windows Server 2008, perform the following steps:

Verify the required Windows Server 2008 services are started. For more information, see

Required DCOM and WMI Services for Windows Server 2008

Enable DCOM for Windows Server 2008. For more information, see

Enabling

DCOM for Windows Server 2008

Configure DCOM communications for Windows Server 2008. For more information, see

Configuring DCOM Communications for Windows Server 2008

Configure User Accounts for DCOM. For more information, see

Windows Server 2008 User Accounts for DCOM

Configure Windows Server 2008 Firewall. For more information, see

Windows Server 2008 Firewall

Configure WMI for Windows Server 2008. For more information, see