AlienVault USM Anywhere Deployment Guide

Getting Ready for Authenticated Scans

Configuring the Network

Getting Traffic from Your Physical Network to the Virtual USM Anywhere Network

Granting Access to Active Directory for USM Anywhere

Installing osquery and CloudWatch Through the Log Agent

Requirements for VMware Sensor Deployment

Task 4: Configure USM Anywhere with the Setup Wizard

A setup wizard specific to each portal guides you through the initial configuration of your

USM Anywhere Sensor to initiate the following: l

Log collection l

Log management l

Plugin management l

Authenticated scans of single assets, an asset group, or a network range

You can use the setup wizard to configure each sensor you create when you receive a prompt, or you can postpone it, or configure sensors manually.

After you install and set up the USM Anywhere Sensor, it communicates with USM Anywhere in the cloud about the assets in your network. The USM Anywhere Sensor then transfers any available raw plugin data to USM Anywhere in the cloud for correlation and event generation, among other things.

About USM Anywhere Upgrades

USM Anywhere upgrades occur as new versions become available, automatically, in the background. The upgrade is transparent, and requires no action on your part.

14 USM Anywhere™ Deployment Guide

About USM Anywhere Upgrades

The upgrade process begins when the USM Anywhere sensor first tries to connect to

USM Anywhere in the cloud. If there is an upgrade available, the download and installation begin.

You do not need to reconfigure a sensor or restart it after an upgrade.

USM Anywhere™ Deployment Guide 15

USM Anywhere Sensor Deployment on VMware

AlienVault provides the VMware sensor to monitor your virtual and physical on-premises infrastructure. When this sensor is deployed and configured for your USM Anywhere instance, security-related data is collected and sent to the AlienVault Cloud for security analysis, threat correlation, and secure, compliance-ready data storage.

The VMware deployment includes NIDS that monitors the networks connected to the listening interfaces. You can also create jobs to collect log data through VMware, including operating system and database-level logs.

This chapter includes the following topics:

VMware Sensor Deployment

Importing the VMware OVF Package

VMware Sensor Connection to USM Anywhere

Completing the VMware Sensor Setup

USM Anywhere™ Deployment Guide 16

VMware Sensor Deployment

Through VMware, you can deploy a USM Anywhere sensor in any of the virtual networks that you want to instrument for network intrusion detection (NIDS), including standard sensor features: l

Log Data Collection l

Authenticated Asset Scans l

Unauthenticated Asset Discovery Scans

AlienVault distributes the VMware sensor as an Open Virtual Format (OVF) file that can be deployed through vCenter or directly to an ESXi Hypervisor version 5.1 and later.

The VMware sensor provides the ability to monitor the packets on networks that you select by attaching one of the sensor network interfaces to a port configured in Promiscuous mode on a

Virtual Switch. This also requires that Port Mirroring is enabled on the upstream physical switch to which the ESXi host is connected.

Note: If your organization uses multiple subnets to allow communication between headquarters and remote offices, you do not need a sensor for each subnet, but you will need a deployed VMware sensor for each physical location that you want to monitor.

There is an option for you to enter credentials for either your vCenter or ESXi servers, which will allow the sensor to discover the VMs registered on the ESXi servers through the vSphere API. This allows for the discovery of assets and also monitors user logins within your vSphere environment and feeds the information back to USM Anywhere.

Deployment Process Overview

The deployment process consists of the following main tasks:

1. Reviewing

requirements

for a VMware sensor deployment.

2. Deploying a VMware sensor by executing the USM_sensor-node.ovf file (see

Importing the

VMware OVF Package ).

Configuring your VMware virtual machine

for USM Anywhere.

4. Providing your

Sensor Authentication Code

in the Sensor UI.

5. Accessing USM Anywhere using the credentials and the URL you obtain after licensing your sensor.

Configuring VMware sensor

for your environment.

17 USM Anywhere™ Deployment Guide

Requirements for VMware Sensor Deployment

Review the following prerequisites to ensure an efficient setup and configuration of the

USM Anywhere VMware sensor: l

Access to VMware ESXi 5.1 or later l

Four cores and 12 GB of memory dedicated to VMware l

150 GB of disk space l

If DHCP is not available, a configured static IP for the management interface and local DNS information

Important: AlienVault recommends assigning a static IP to deploy a sensor. If DHCP changes the IP address of the sensor, you must update all the IP addresses on all the devices that are forwarding logs to the sensor through syslog.

Internet connectivity to the network in which you plan to install the VMware sensor l

Port mirroring setup for network monitoring (see

Configuring VMware ESX Virtual Switches for

Port Monitoring )

Administrative credentials for devices from which you want to forward logs to the VMware sensor l

Configuration on firewall or other security device to send UDP syslog (if it is capable of exporting security logs through UDP syslog) l

Network topology information to run asset discovery l

Administrative credentials on your devices for authenticated asset scans l

(Optional) Access to a span port to monitor network traffic for IDS

Outbound Ports and Protocols

A deployed USM Anywhere Sensor requires opening the firewall for communication with USM

Anywhere in the cloud for the following ports and protocols: l

SSL over TCP on port 7100 l

HTTP over port 80 for product updates l

Amazon Web Services IPs over ports 443 and 7100 l

Access to

*.alienvault.cloud

over port 443 l

SSH over port 22 for USM Anywhere Remote Support

USM Anywhere™ Deployment Guide 18

Importing the VMware OVF Package

Inbound Ports

You do not need to open any inbound ports in the firewall of your local network, because the USM

Anywhere Sensor receives no inbound connections from outside the firewall.

When you configure plugins to forward log data to the USM Anywhere Sensor from within your local network, the sensor receives inbound connections through port 514 over syslog.

Importing the VMware OVF Package

This procedure loads the OVF package, containing the VMware sensor image and an OVF template, on a VMware ESXi instance.

Note: This procedure references the VMware vSphere client. If you are using a different client, refer to that vendor's documentation and extrapolate from this procedure.

To load the OVF package on a VMware ESXi instance

1. Download the VMware OVF package.

This package is provided in

.zip

format from the USM Anywhere sensor downloads page: https://www.alienvault.com/products/usm-anywhere/sensor-downloads .

Note: Downloads can take 30 minutes or more.

2. When prompted, save the ZIP file.

3. Decompress the usm-sensor-vmware.zip

package to your desktop or wherever you normally save VMware packages.

It should extract the following files: l deploy_config.iso

USM_sensor-node.ovf

USM-disk1.vmdk

USM.mf

4. In VMware Manager, choose File >Deploy OVF Template.

VMware Manager displays the Deploy OVF Template page.

5. Browse to

USM_sensor-node.ovf

(one of the files you just extracted) and click Next.

6. Click Next for each of the following pages.

You do not need to change the settings unless you want to change the default sensor name.

19 USM Anywhere™ Deployment Guide

USM Anywhere Setup on the VMware Virtual Machine l

OVF Template Details l

(Optional) Name and Location — You may change the name, if desired.

Disk Format

7. On the Ready to Complete page, select Power on after deployment and click Finish.

Deployment of the virtual image takes several minutes. When the deployment completes,

VMware Manager displays the following:

Deploying USM Anywhere Sensor Node

Deploying disk 1 of 2 from: (File Location)

Deploying disk 2 of 2 from: (File Location)

Completed Successfully

Note: If you chose a different name for your sensor, that name displays in the first message instead of the default name.

8. Click Close.

9. Connect to the console of the USM Anywhere Virtual Appliance using one of the following methods: l

Select the new VMware virtual machine from the inventory list of the VMware Management page, choose to open a console, and then power it on.

In the console toolbar, click the console icon.

The system initialization screen displays the URL with which to access USM Anywhere.

USM Anywhere Setup on the VMware Virtual Machine

There is some configuration required within the console of the sensor. After this initial configuration, you use the USM Anywhere web UI to further configure the sensor, and all other sensors that you connect to USM Anywhere.

Perform the initial configuration tasks on the VMware virtual machine, using the USM Anywhere

Sensor console.

USM Anywhere™ Deployment Guide 20

USM Anywhere Setup on the VMware Virtual Machine

Changing the Keyboard Layout and Administrative Password

To change keyboard layout and the administrative password

1. Log in using the credentials found on screen.

2. (Optional) Configure the keyboard if you use keyboard layout other than the U.S. default.

3. Set a new password for the sysadmin user.

During the installation, your system acquires the initial IP address through DHCP. If DHCP is not enabled, you must configure it manually.

If your system sets an IP address automatically, note the web URL and exit from the setup and follow the instructions under

VMware Sensor Connection to USM Anywhere .

21 l

If your system does not set an IP address automatically, set a static IP address , so that it remains unchanged in future.

After changing the sysadmin password, a message box displays, announcing that the system was unable to acquire an IP address from a DHCP server, and you must therefore configure it manually.

USM Anywhere™ Deployment Guide

USM Anywhere Setup on the VMware Virtual Machine

Configuring a Static IP Address

To configure a static IP address

1. Navigate to Network Configuration > Configure Management Interface > Set a Static Management IP Address.

2. Enter the IP Address, subnet, and gateway information in each input screen.

3. Press Enter (OK).

Configuring DNS

To configure DNS

1. Navigate to the option Network Configuration > Configure DNS.

2. Enter the primary DNS and press Enter (OK).

3. (Optional) Enter the secondary DNS and press Enter (OK).

A text box appears to confirm that you want to apply changes.

4. Press Enter (Yes).

Note: Check your settings through Network Configuration > View Network Configuration.

USM Anywhere™ Deployment Guide 22

VMware Sensor Connection to USM Anywhere

After obtaining the IP address of your USM Anywhere web portal, you must provision your

USM Anywhere instance from the AlienVault Secure Cloud. This IP address is provided when you save your management interface settings in the sensor console and it directs you to the sensor connection web interface.

When you access the web UI, you must register the sensor using the initial Authentication Code

(starts with a "C"), which requests a USM Anywhere instance and defines its attributes (such as how many sensors to allow, how much storage to provide, and what email address is used to create the initial user account).

Important: Instance provisioning takes place only for the first deployed sensor. If you are deploying an additional sensor in your USM Anywhere environment, you can simply register the sensor using the generated authentication code (starts with an "S") and use the Setup

Wizard to complete the sensor deployment.

To register your sensor and provision the instance

1. Open a web browser and enter the IP address.

2. Click Start Setup to start the process of connecting to the USM Anywhere Sensor.

The USM Anywhere instance takes about 20 minutes to configure upon request by the initial sensor. When the USM Anywhere instance is provisioned and running, you’ll see a welcome message that allows you to access it from your web browser.

USM Anywhere™ Deployment Guide

VMware Sensor Connection to USM Anywhere

Use this link to open the secured Web console for your USM Anywhere instance. You and the other USM Anywhere users in your organization can access this console from a web browser on any system with Internet connectivity.

Note: You'll also receive an email from AlienVault with the link in it.

Configure the Initial Login Credentials

When you link to a newly-provisioned USM Anywhere instance, you must configure the password for the initial user account, which is the default administrator as defined in your subscription.

To configure login credentials

1. Click the link in the welcome message.

This displays a prompt to set the password to use for the default administrator of USM

Anywhere.

2. Enter the password, and again to confirm.

USM Anywhere requires a minimum password length of eight characters, with a maximum length of 128 characters. The password must combine numerical digits (0-9), uppercase letters

(A-Z), and lowercase letters (a-z). Special characters, such as hyphen (-) and underscore (_) are supported, but optional.

Note: USM Anywhere passwords expire after 90 days. When your password expires,

USM Anywhere enforces the password change when you next log into the system using the current (now expired) password. A new password must be different than the previous four passwords.

3. Click Save & Continue.

USM Anywhere™ Deployment Guide 24

Completing the VMware Sensor Setup

4. When the login page appears, enter the password you just set, select acceptance of the terms of service, and click Login.

Completing the VMware Sensor Setup

After you initialize a new USM Anywhere Sensor, you must configure it in the setup wizard. As the sensor configuration is completed, USM Anywhere performs specific actions, like running an asset discovery scan or collecting security events from a predefined cloud storage location.

Accessing the Setup Wizard

The Setup Wizard launches under the following circumstances: l

When you first log into the USM Anywhere web interface and see the WELCOME TO USM

ANYWHERE page, click Get Started.

If you configured a first sensor, but did not complete the setup and then logged out, the Setup wizard launches to remind you to finalize configuration on the remaining sensors when you log in again.

When you select SETTINGS > DEPLOYMENT and click the configure icon for the sensor.

Any unconfigured sensor displays a red x in the Configuration column.

USM Anywhere™ Deployment Guide

Completing the VMware Sensor Setup

Configuring the VMware Sensor in the Setup Wizard

The first time you log into the web interface from the WELCOME TO USM ANYWHERE web page, the Setup Wizard prompts you to complete the configuration of the first deployed sensor. Thereafter, you can use the wizard UI to add an additional sensor or to change a sensor configuration.

Note: You must have already configured your network interfaces for VMware. For more information, see

Granting Access to Active

Within the Setup Wizard, complete the configuration on each page.

VMWARE CONFIGURATION

The first page in the Setup Wizard for a VMware sensor is the VMWARE CONFIGURATION page.

The vCenter/ESXi details that you provide on this page will allow USM Anywhere to discover assets in your VMware environment and also collect events from that environment.

Note: If you are modifying the configuration of a sensor that is already connected, these settings are not required to proceed. You can click the Next button at the bottom-right to skip this step.

USM Anywhere™ Deployment Guide 26

Completing the VMware Sensor Setup

To complete the VMware configuration step

1. Enter your VCenter or vSphere IP address and user credentials.

2. Click Save Credentials.

3. Click Next.

The wizard displays the next page in the setup process, ASSET DISCOVERY.

USM Anywhere™ Deployment Guide

Completing the VMware Sensor Setup

ASSET DISCOVERY

When you move forward to the ASSET DISCOVERY page, a dialog automatically appears and prompts you to allow asset scanning. USM Anywhere must discover your assets to enable security monitoring on them.

To complete the asset discovery task

1. Click Yes to start the automatic asset discovery.

Or, if you prefer to add the assets manually or scan another network, click No and skip to the next step.

During the automated scan, the Scan Networks status bar appears and displays the number of assets detected in your network range.

USM Anywhere™ Deployment Guide 28

Completing the VMware Sensor Setup

When the scan stops, you have the option to either scan a different set of assets (click Scan

Another) or continue with asset discovery setup options (click Next).

When the initial asset scan dialog closes, the ASSET DISCOVERY page displays status information for an ongoing scan or any discovered assets for completed scans.

USM Anywhere™ Deployment Guide

Completing the VMware Sensor Setup

2. (Optional) Click Scan Networks to scan a network range that you specify.

This runs an Nmap (Network Mapper) scan to discover hosts and services running on your environment.

3. When all the needed assets are discovered, click Next at the bottom of the page.

The wizard displays the next page in the setup process, ACTIVE DIRECTORY.

ACTIVE DIRECTORY

The optional ACTIVE DIRECTORY setup page configures USM Anywhere to collect information from your Azure Active Directory (AD) account. To monitor Windows systems effectively,

USM Anywhere needs access to AD (Active Directory) server to collect inventory information.

AlienVault recommends that you create a dedicated AD account with membership in the Domain

Admins group to be used by USM Anywhere to log in into the Windows systems. You also need to activate WinRM in the Domain Controller and in all the hosts that you want to scan. You can do this by using a group policy for all the systems in your Active Directory.

Important: Before this feature is fully functional, you must allow access to the USM Anywhere

Sensor in the Active Directory server. For more information see,

Directory for USM Anywhere

USM Anywhere™ Deployment Guide 30

Completing the VMware Sensor Setup

To complete the AD access configuration

1. Provide the AD credentials for USM Anywhere: l

Active Directory IP Address — Enter the IP address for the AD instance.

Username — Enter your username as administrator of the account.

Password — Enter your administrator's password.

Domain — Enter the domain for the AD instance.

2. Click Scan Active Directory.

After a successful launch of the scan, a confirmation dialog appears.

USM Anywhere™ Deployment Guide

Completing the VMware Sensor Setup

3. Click Accept.

The scan continues in the background.

Upon completion, another dialog appears and provides information about the number of assets

USM Anywhere discovered. It also prompts you to decide if you want to scan for hosts and services running in your environment.

Click CANCEL to opt out of this scan.

4. (Optional) If you want to scan for other hosts and services, click OK.

5. Click Next after the scan ends.

The wizard displays the next page in the setup process, NETWORK SECURITY

MONITORING.

NETWORK SECURITY MONITORING

The NETWORK SECURITY MONITORING page shows the status of the network interfaces monitored by the sensor (it could take a few moments to load the interfaces). All network adapters are configured for network monitoring by default.

You must manually enable port mirroring/spanning and/or promiscuous mode in a virtual switch to send a copy of the network traffic you want to analyze to these interfaces. This page provides links to documentation about how to configure your networking to allow for the interfaces to see the network traffic and perform Network Intrusion Detection.

Note: You must have already configured your network interfaces for VMware. For more information, see

Virtual Switches for Port Monitoring

USM Anywhere™ Deployment Guide 32

Completing the VMware Sensor Setup

Use this page to verify that USM Anywhere is able to monitor your network traffic for security events.

Note: You will see red X icons nest to the interfaces if the port mirroring or promiscuous mode is not configured. You might also see these icons if the network interfaces have not seen any traffic in the past 30 seconds.

1. To access detailed information about port mirroring set up, click How do I set up port mirroring?.

This opens a dialog that can direct you to specific information about your device.

If you have not yet set up port mirroring, you can also go directly to

Configuring VMware ESX

2. Click Next.

LOG MANAGEMENT

On the LOG MANAGEMENT page, you see the IP addresses of the assets you added during the asset discovery configuration. You also see the port number. (The port is the same for all

USM Anywhere Sensors.)

USM Anywhere collects third-party device data through syslog on port 514 by default. To configure any third-party devices to send data to USM Anywhere, you must give them the IP address of your

USM Anywhere Sensor and the port number.

USM Anywhere™ Deployment Guide

Completing the VMware Sensor Setup

Make sure that you've granted the necessary permissions for your operating system to allow

USM Anywhere to access its logs. You can also integrate a wide variety of plugins to send log data over syslog to the USM Anywhere Sensor.

To find out how to configure your operating system and supported third-party devices to forward syslog log data, see the following related topics: l

Log collection from a Linux System —

Log collection from a Windows System —

Log collection from other devices using a plugin —

About Hyper-V Sensor Deployment

Note: Because the log scan can take some time, you may not immediately see all the automatically discovered log sources right after deploying the first sensor.

When you've finished the log collection setup and integrated any needed plugins, verify that the data transfer is occurring.

Click Next when this step is complete.

USM Anywhere™ Deployment Guide 34

Completing the VMware Sensor Setup

THREAT INTELLIGENCE

On the Threat Intelligence page, you can connect the deployed sensor to your AlienVault®

Open Threat Exchange® (OTX™) account. OTX is an open information-sharing and analysis network that provides access to real-time information about issues and attack threats that may impact your organization, allowing you to learn from and work with others who have already experienced such attacks. AlienVault Labs and other security researchers constantly monitor, analyze, reverse engineer, and report on sophisticated threats including malware, botnets, phishing campaigns, and more. An OTX pulse consists of one or more indicators of compromise (IOCs) that constitute a threat or define a sequence of actions that could be used to carry out an attack.

When you configure the OTX connection, the USM Anywhere Sensor receives raw pulse data from

OTX. After the deployed sensor starts to receive this data, USM Anywhere correlates that data and generates related OTX pulse and IP Reputation-related security events and alarms when it detects

IOCs interacting with assets in your environment. These events are displayed in the Open Threat

Exchange dashboard, which is available from the DASHBOARDS menu.

Note: If you do not already have an OTX account, click the Signup for an OTX account link in the page. This opens another browser tab or window that displays the OTX signup page. After you confirm your email address, you can log into OTX and retrieve the unique API key for your account.

1. Log into OTX and open the API page ( https://otx.alienvault.com/api/ ).

2. In the DirectConnect API Usage panel, click the Copy ( ) icon to copy your unique

OTX connection key.

3. Return to the Threat Intelligence page of the USM Anywhere Sensor setup wizard and paste the value in the OTX Key text box.

USM Anywhere™ Deployment Guide

Completing the VMware Sensor Setup

4. Click Validate OTX Key.

With a successful validation of the key, the status at the top of the page changes to Valid

OTX key.

Click Next when this task is complete.

USM Anywhere™ Deployment Guide 36

Completing the VMware Sensor Setup

SETUP COMPLETE

The Congratulations! page summarizes the status of your configuration.

Click Start Using USM Anywhere, which takes you to the Overview dashboard.

Next...

Now's a great time to run a vulnerability scan. You can learn how to run a vulnerability scan by going to Vulnerability Assessment in the USM Anywhere User Guide .

USM Anywhere™ Deployment Guide

USM Anywhere Sensor Deployment on Microsoft Hyper-V

Microsoft Hyper-V is a hypervisor that lets you create and manage a virtualized computing environment by using virtualization technology that is built into Windows Server. Through Microsoft

Hyper-V, you can deploy a USM Anywhere sensor in any of the virtual networks that you want to instrument for threat monitoring.

The Hyper-V sensor deployment includes NIDS that monitors the networks connected to the listening interfaces.

This chapter includes the following topics:

Requirements for Hyper-V Sensor Deployment

Creating the Hyper-V Virtual Machine

Hyper-V Sensor Connection to USM Anywhere

Completing the Hyper-V Sensor Setup

USM Anywhere™ Deployment Guide 38

About Hyper-V Sensor Deployment

AlienVault provides a package containing the following files to configure a sensor on Microsoft

Hyper-V: l

A disk image file: deploy_config l

An XML document: USM_sensor-node l

The hard disk images files: usm-data-disk.vhdx and usm-os-disk.vhd

If your organization uses multiple subnets to allow communication between headquarters and remote offices, you do not need a sensor for each subnet, but you will need a Hyper-V sensor for each physical location that you want to monitor.

Note: For further information about Hyper-V, see the Microsoft website.

Deployment Process Overview

The deployment process consists of the following main tasks:

1. Reviewing

requirements

for a Hyper-V sensor deployment.

Creating , configuring, and starting the Hyper-V VM virtual machine .

Configuring your Hyper-V virtual machine

for USM Anywhere.

4. Providing your

Sensor Authentication Code

in the Sensor UI.

5. Accessing USM Anywhere using the credentials and the URL you obtain after licensing your sensor.

Configuring the Hyper-V sensor

for your environment.

Requirements for Hyper-V Sensor Deployment

Review the following prerequisites to ensure an efficient setup and configuration of USM Anywhere: l

Operating system must be 2012 R2 with either Hyper-V Manager or Virtual Machine Manager l

4 cores and 12 GB of memory dedicated to the Hyper-V l

150 GB of disk space l

If DHCP is unavailable, a static IP for the management interface and local DNS information

Important: AlienVault recommends that you assign a static IP when deploying a sensor. If

DHCP were to change the IP address of the sensor, you would otherwise need to update the IP addresses on all the devices forwarding logs to the sensor through syslog.

Internet connectivity from the appliance l

Network topology information to run asset discovery

39 USM Anywhere™ Deployment Guide

Requirements for Hyper-V Sensor Deployment l

Port mirroring setup for network monitoring l

Administrative credentials for authenticated asset scans l

Administrative credentials for devices from which you want to forward logs to the Hyper-V sensor l

(Optional) A span port to monitor network traffic for IDS

Outbound Ports and Protocols

A deployed USM Anywhere Sensor requires opening the firewall for communication with USM

Anywhere in the cloud for the following ports and protocols: l

SSL over TCP on port 7100 l

HTTP over port 80 for product updates l

Amazon Web Services IPs over ports 443 and 7100 l

Access to

*.alienvault.cloud

over port 443 l

SSH over port 22 for USM Anywhere Remote Support

Inbound Ports

You do not need to open any inbound ports in the firewall of your local network, because the USM

Anywhere Sensor receives no inbound connections from outside the firewall.

When you configure plugins to forward log data to the USM Anywhere Sensor from within your local network, the sensor receives inbound connections through port 514 over syslog.

Ways to Manage Hyper-V

You can deploy a Hyper-V virtual machine, using either of the following: l

Microsoft Hyper-V Manager, an administrative tool for managing local and remote Hyper-V servers. For more information, see

Creating the Hyper-V Virtual Machine

System Center Virtual Machine Manager 2012 , designed for managing large numbers of virtual servers, based on Microsoft Virtual Server and Hyper-V. For more information, see

Creating the Hyper-V Virtual Machine .

USM Anywhere™ Deployment Guide 40

Creating the Hyper-V Virtual Machine

Before you deploy the Hyper-V sensor, you must create, configure, and start the virtual machine

(VM) using either Hyper-V Manager or System Center Virtual Manager (SCVMM) 2012.

Creating the VM with Hyper-V Manager

Follow these procedures to create, configure, and start the virtual machine using Hyper-V Manager.

Creating the Virtual Machine

To create a virtual machine with Hyper-V Manager

1. Open the Hyper-V Manager and connect to the server.

2. From the Actions panel, go to New > Virtual Machine.

The New Virtual Machine Wizard launches. You can simply click Next in the entry page.

3. In Specify Name and Location, enter a name for the new virtual machine and then click Next.

4. In Specify Generation, choose Generation 1 for the virtual machine and then click Next.

5. In Assign Memory, change the value of the Startup memory to 12288 MB.

Also make sure that the Use Dynamic Memory option is disabled. Click Next when complete.

USM Anywhere™ Deployment Guide

Creating the Hyper-V Virtual Machine

6. In Configure Networking, connect the new virtual machine to the desired network and then click

Next.

7. In Connect Virtual Hard Disk, select Use an existing virtual hard disk and then click Browse to locate the usm-os-disk.vhd file that was part of the download from the USM Anywhere deployment site.

Note: You will add the data disk later in another step, because the wizard doesn't support this.

8. In Complete the New Virtual Machine Wizard, click Next and then Finish.

Configuring the Virtual Machine

To configure a virtual machine using the Hyper-V Manager

1. Select the virtual machine you previously created, and click Settings.

2. In the new dialog box, select click Processor in the left-hand pane and set the Number of Virtual Processors to four.

3. Click Apply.

4. In the left-hand pane, click IDE Controller 0.

5. Select Hard Drive and click Add, then click Browse to locate the usm-data-disk.vhdx file that was part of the download from the USM Anywhere download site.

6. At the top-left corner of the page, click +Add Hardware, then Network Adapter External

Network > Add to add five network adapters.

USM Anywhere™ Deployment Guide 42

Creating the Hyper-V Virtual Machine

7. Click OK.

8. Click IDE Controller 1 > DVD Drive.

9. Click Browse and locate the deploy_config.iso image; click Apply.

Starting the Virtual Machine

To connect the virtual machine to USM Anywhere l

Select your virtual machine and, in the right panel, click Connect.

The system initialization screen appears and displays the URL used to access USM Anywhere.

USM Anywhere™ Deployment Guide

Creating the Hyper-V Virtual Machine

Creating the VM with SCVMM 2012

Follow these procedures to create and start the virtual machine using System Center Virtual

Machine Manager (SCVMM) 2012.

Creating the Virtual Machine

To create a virtual machine with SCVMM 2012

1. Connect to SCVMM 2012.

2. Select Library > VM Templates.

3. Select the USM Anywhere VM Template under VM Templates, and click Create Virtual

Machine.

4. Enter a name for the virtual machine and then click Next.

5. In the Configure Hardware, click Next.

6. In Select Destination, choose whether to deploy or store the virtual machine and then click

Next.

7. In Select Host, select a destination for the virtual machine and then click Next.

8. In Configure Settings, review the virtual machine settings and then click Next.

9. In Add Properties, change the automatic actions, if needed, and then click Next.

USM Anywhere™ Deployment Guide 44

Creating the Hyper-V Virtual Machine

10. In Summary, confirm the settings and then click Next.

The Jobs window appears and shows the virtual machines in the process of creation.

When the process finishes, you may close the window.

45 USM Anywhere™ Deployment Guide

USM Anywhere Setup on the Hyper-V Virtual Machine

Starting the Virtual Machine

To connect your machine to USM Anywhere l

Right-click the virtual machine and select Connect or View > Connect via Console.

The system initialization screen appears and displays the URL you can use to access

USM Anywhere.

USM Anywhere Setup on the Hyper-V Virtual Machine

Perform the initial configuration tasks on the Hyper-V virtual machine, using the USM Anywhere sensor console.

USM Anywhere™ Deployment Guide 46

USM Anywhere Setup on the Hyper-V Virtual Machine

Changing the Keyboard Layout and Administrative Password

To change keyboard layout and the administrative password

1. Log in using the credentials found on screen.

2. (Optional) Configure the keyboard if you use keyboard layout other than the U.S. default.

3. Set a new password for the sysadmin user.

During the installation, your system acquires the initial IP address through DHCP. If DHCP is not enabled, you must configure it manually.

If your system sets an IP address automatically, note the web URL and exit from the setup and follow the instructions under

Hyper-V Sensor Connection to USM Anywhere

47 l

If your system does not set an IP address automatically, set a static IP address , so that it remains unchanged in future.

After changing the sysadmin password, a message box displays, announcing that the system was unable to acquire an IP address from a DHCP server, and you must therefore configure it manually.

USM Anywhere™ Deployment Guide

USM Anywhere Setup on the Hyper-V Virtual Machine

Configuring a Static IP Address

To configure a static IP address

1. Navigate to Network Configuration > Configure Management Interface > Set a Static Management IP Address.

2. Enter the IP Address, subnet, and gateway information in each input screen.

3. Press Enter (OK).

Configuring DNS

To configure DNS

1. Navigate to the option Network Configuration > Configure DNS.

2. Enter the primary DNS and press Enter (OK).

3. (Optional) Enter the secondary DNS and press Enter (OK).

A text box appears to confirm that you want to apply changes.

4. Press Enter (Yes).

Note: Check your settings through Network Configuration > View Network Configuration.

USM Anywhere™ Deployment Guide 48

Hyper-V Sensor Connection to USM Anywhere

After obtaining the IP address of your USM Anywhere web portal, you must provision your

When you access the web UI, you must register the sensor using the initial Authentication Code

Wizard to complete the sensor deployment.

To register your sensor and provision the instance

1. Open a web browser and enter the IP address.

2. Click Start Setup to start the process of connecting to the USM Anywhere Sensor.

USM Anywhere™ Deployment Guide

Hyper-V Sensor Connection to USM Anywhere

Note: You'll also receive an email from AlienVault with the link in it.

Configure the Initial Login Credentials

When you link to a newly-provisioned USM Anywhere instance, you must configure the password for the initial user account, which is the default administrator as defined in your subscription.

To configure login credentials

1. Click the link in the welcome message.

This displays a prompt to set the password to use for the default administrator of USM

Anywhere.

2. Enter the password, and again to confirm.

USM Anywhere requires a minimum password length of eight characters, with a maximum length of 128 characters. The password must combine numerical digits (0-9), uppercase letters

(A-Z), and lowercase letters (a-z). Special characters, such as hyphen (-) and underscore (_) are supported, but optional.

Note: USM Anywhere passwords expire after 90 days. When your password expires,

USM Anywhere enforces the password change when you next log into the system using the current (now expired) password. A new password must be different than the previous four passwords.

3. Click Save & Continue.

USM Anywhere™ Deployment Guide 50

Completing the Hyper-V Sensor Setup

4. When the login page appears, enter the password you just set, select acceptance of the terms of service, and click Login.

Completing the Hyper-V Sensor Setup

After you initialize a new USM Anywhere Sensor, you must configure it using the setup wizard. As the sensor configuration is completed, USM Anywhere performs specific actions, like running an asset discovery scan or collecting security events from a predefined cloud storage location.

Accessing the Setup Wizard

The Setup Wizard launches under the following circumstances: l

When you first log into the USM Anywhere web interface and see the WELCOME TO USM

ANYWHERE page, click Get Started.

If you configured a first sensor, but did not complete the setup and then logged out, the Setup wizard launches to remind you to finalize configuration on the remaining sensors when you log in again.

When you select SETTINGS > DEPLOYMENT and click the configure icon for the sensor.

Any unconfigured sensor displays a red x in the Configuration column.

USM Anywhere™ Deployment Guide

Completing the Hyper-V Sensor Setup

Configuring the Sensor in the Setup Wizard

Note: You must have already configured your network interfaces for Hyper-V. For more information, see

Granting Access to Active

From the WELCOME TO USM ANYWHERE page (not shown), click Get Started. Within the

Setup Wizard, complete the configuration on each page.

USM Anywhere™ Deployment Guide 52

Completing the Hyper-V Sensor Setup

ASSET DISCOVERY

To complete the asset discovery task

1. Click Yes to start the automatic asset discovery.

Or, if you prefer to add the assets manually or scan another network, click No and skip to the next step.

During the automated scan, the Scan Networks status bar appears and displays the number of assets detected in your network range.

53 USM Anywhere™ Deployment Guide

Completing the Hyper-V Sensor Setup

When the scan stops, you have the option to either scan a different set of assets (click Scan

Another) or continue with asset discovery setup options (click Next).

When the initial asset scan dialog closes, the ASSET DISCOVERY page displays status information for an ongoing scan or any discovered assets for completed scans.

USM Anywhere™ Deployment Guide 54

Completing the Hyper-V Sensor Setup

2. (Optional) Click Scan Networks to scan a network range that you specify.

This runs an Nmap (Network Mapper) scan to discover hosts and services running on your environment.

3. When all the needed assets are discovered, click Next at the bottom of the page.

The wizard displays the next page in the setup process, ACTIVE DIRECTORY.

ACTIVE DIRECTORY

The optional ACTIVE DIRECTORY setup page configures USM Anywhere to collect information from your Azure Active Directory (AD) account. To monitor Windows systems effectively,

USM Anywhere needs access to AD (Active Directory) server to collect inventory information.

AlienVault recommends that you create a dedicated AD account with membership in the Domain

Important: Before this feature is fully functional, you must allow access to the USM Anywhere

Sensor in the Active Directory server. For more information see,

Directory for USM Anywhere

USM Anywhere™ Deployment Guide

Completing the Hyper-V Sensor Setup

To complete the AD access configuration

1. Provide the AD credentials for USM Anywhere: l

Active Directory IP Address — Enter the IP address for the AD instance.

Username — Enter your username as administrator of the account.

Password — Enter your administrator's password.

Domain — Enter the domain for the AD instance.

2. Click Scan Active Directory.

After a successful launch of the scan, a confirmation dialog appears.

USM Anywhere™ Deployment Guide 56

Completing the Hyper-V Sensor Setup

3. Click Accept.

The scan continues in the background.

Upon completion, another dialog appears and provides information about the number of assets

USM Anywhere discovered. It also prompts you to decide if you want to scan for hosts and services running in your environment.

Click CANCEL to opt out of this scan.

4. (Optional) If you want to scan for other hosts and services, click OK.

5. Click Next after the scan ends.

The wizard displays the next page in the setup process, NETWORK SECURITY

MONITORING.

NETWORK SECURITY MONITORING

Note: You must have already configured your network interfaces for Hyper-V. For more information, see

Configuring a Hyper-V Virtual

USM Anywhere™ Deployment Guide

Completing the Hyper-V Sensor Setup

Use this page to verify that USM Anywhere is able to monitor your network traffic for security events.

1. To access detailed information about port mirroring set up, click How do I set up port mirroring?.

This opens a dialog that can direct you to specific information about your device.

If you have not yet set up port mirroring, you can also go directly to

Machine for Port Mirroring on a Windows Server 2012+ .

2. Click Next.

LOG MANAGEMENT

On the LOG MANAGEMENT page, you see the IP addresses of the assets you added during the asset discovery configuration. You also see the port number. (The port is the same for all

USM Anywhere Sensors.)

USM Anywhere collects third-party device data through syslog on port 514 by default. To configure any third-party devices to send data to USM Anywhere, you must give them the IP address of your

USM Anywhere Sensor and the port number.

USM Anywhere™ Deployment Guide 58

Completing the Hyper-V Sensor Setup

Make sure that you've granted the necessary permissions for your operating system to allow

USM Anywhere to access its logs. You can also integrate a wide variety of plugins to send log data over syslog to the USM Anywhere Sensor.

To find out how to configure your operating system and supported third-party devices to forward syslog log data, see the following related topics: l

Log collection from a Linux System —

Log collection from a Windows System —

Log collection from other devices using a plugin —

About AWS Sensor Deployment

Note: Because the log scan can take some time, you may not immediately see all the automatically discovered log sources right after deploying the first sensor.

When you've finished the log collection setup and integrated any needed plugins, verify that the data transfer is occurring.

Click Next when this step is complete.

USM Anywhere™ Deployment Guide

Completing the Hyper-V Sensor Setup

CLOUD SERVICES

Use the Cloud Services page to configure USM Anywhere to collect information from any of the supported cloud services apps. These apps allow you to monitor and detect threats against your cloud services accounts, such as G Suite (Google Apps) and O365, directly from USM Anywhere.

When configured , the cloud services app collects log data from via the cloud service API and analyzes that data against our built-in threat intelligence to look for anomalies and intrusions.

To setup cloud services in USM Anywhere

1. Select the cloud service app for each service where you want to monitor activity.

2. Click Next.

USM Anywhere displays a configuration page for each cloud service you selected.

3. Complete the form for its configuration and click Save Credentials.

4. Click Next. when this step is complete.

THREAT INTELLIGENCE

On the Threat Intelligence page, you can connect the deployed sensor to your AlienVault®

When you configure the OTX connection, the USM Anywhere Sensor receives raw pulse data from

OTX. After the deployed sensor starts to receive this data, USM Anywhere correlates that data and generates related OTX pulse and IP Reputation-related security events and alarms when it detects

IOCs interacting with assets in your environment. These events are displayed in the Open Threat

Exchange dashboard, which is available from the DASHBOARDS menu.

USM Anywhere™ Deployment Guide 60

Completing the Hyper-V Sensor Setup

1. Log into OTX and open the API page ( https://otx.alienvault.com/api/ ).

2. In the DirectConnect API Usage panel, click the Copy ( ) icon to copy your unique

OTX connection key.

3. Return to the Threat Intelligence page of the USM Anywhere Sensor setup wizard and paste the value in the OTX Key text box.

61 USM Anywhere™ Deployment Guide

Completing the Hyper-V Sensor Setup

4. Click Validate OTX Key.

With a successful validation of the key, the status at the top of the page changes to Valid

OTX key.

Click Next when this task is complete.

USM Anywhere™ Deployment Guide 62

Completing the Hyper-V Sensor Setup

SETUP COMPLETE

The Congratulations! page summarizes the status of your configuration.

Click Start Using USM Anywhere, which takes you to the Overview dashboard.

Next...

Now's a great time to run a vulnerability scan. You can learn how to run a vulnerability scan by going to Vulnerability Assessment in the

USM Anywhere User Guide .

USM Anywhere™ Deployment Guide

USM Anywhere Sensor Deployment on AWS

The AWS sensor provides operational visibility into the security of your Amazon Web Services

(AWS) environment. Based on the collected log information, USM Anywhere analyzes the data generated by your AWS environment and provides real-time alerting to identify malicious activity.

The AWS sensor is deployed into your AWS environment to provide ultimate control over the installation and the data contained within it, and also avoiding any external access to your environment.

This chapter includes the following topics:

Requirements for AWS Sensor Deployment

Deploying the AWS Sensor

AWS Sensor Connection to USM Anywhere

Completing the AWS Sensor Setup

Adding Another Sensor to Other AWS Accounts

Enabling syslog Connections in an AWS VPC

AWS Log Discovery in USM Anywhere

Creating a New CloudWatch Collection Job

Creating a New AWS S3 Access Collection Job

USM Anywhere™ Deployment Guide 64

About AWS Sensor Deployment

All USM Anywhere Sensors allow for authenticated scans of assets by leveraging stored credentials that you define on USM Anywhere. This allows USM Anywhere to detect potential vulnerabilities, installed software packages, as well as running processes and services. Unlike the other sensors, the AWS sensor queries AWS directly to discover assets using an AWS API.

AlienVault distributes the AWS sensor as a CloudFormation Template in two different forms. The one that you use depends on the type of AWS environment where you want to deploy it (a Virtual

Private Cloud or the EC2-Classic).

Log Collection and Scans

The AWS sensor collects

AWS logs

and system logs, and generates asset scans and vulnerability assessments, consisting of the following: l

AWS CloudTrail Log l

AWS CloudWatch Log l

AWS Classic Load Balancer Log l

AWS Application Load Balancer Log l

S3 Access Logs l

Operational logs for critical software packages deployed, such as HTTP servers and database servers l

Asset scans on your instances to inventory installed software packages, running processes, and services l

Periodic vulnerability assessments

Log Analysis

USM Anywhere analyzes these logs in these stages:

1. Collects logs from systems and software running in your environment

2. Configures log line processing and generates events l

Includes IP addresses and timestamps culled from extracted log line data l

Adds other data to the event, such as security context and environmental information

3. Analyzes events and stores them

65 USM Anywhere™ Deployment Guide

Requirements for AWS Sensor Deployment

USM Anywhere runs in either an Amazon Virtual Private Cloud (VPC) or in the classic mode of

Amazon Elastic Compute Cloud (Amazon EC2).

Requirement t2.large / m3.large instance

12-GB EBS volume

Description t2. large instance in a virtual private cloud (VPC) or an m3. large in EC2-Classic

Provides short-term storage for your data as it is processed. Recommended volume: 12-GB elastic block store (EBS).

Internet connection to USM Anywhere cloud

Important: If you download and deploy the t2 instance, you must launch it into a virtual private cloud (VPC); this instance type is not supported on the EC2-Classic platform. You cannot change the instance type of an existing instance in EC2-Classic to a T2 instance type.

Application Service Dependencies

With the aid of the CloudFormation Template, you can automatically deploy USM Anywhere as a service into your environment. Review the following lists for information about the outbound/inbound

IP addresses, ports, and services used by USM Anywhere for the AWS sensor deployment.

Outbound Ports and Protocols

A deployed USM Anywhere Sensor requires opening the firewall for communication with USM

Anywhere in the cloud for the following ports and protocols: l

SSL over TCP on port 7100 l

HTTP over port 80 for product updates l

Amazon Web Services IPs over ports 443 and 7100

USM Anywhere™ Deployment Guide 66

Requirements for AWS Sensor Deployment l

Access to

*.alienvault.cloud

over port 443 l

SSH over port 22 for USM Anywhere Remote Support

The AWS sensor potentially needs outbound access to specific AWS resources, based on the

Note: USM Anywhere normally gives systems explicit access to the AWS API.

Inbound Ports

You do not need to open any inbound ports in the firewall of your local network, because the USM

Anywhere Sensor receives no inbound connections from outside the firewall.

When you configure plugins to forward log data to the USM Anywhere Sensor from within your local network, the sensor receives inbound connections through port 514 over syslog.

AWS Services

USM Anywhere uses the following AWS services: l

AWS CloudWatch l

AWS CloudTrail l

Elastic Load Balancing l

Amazon Simple Storage Service (AWS S3) l

Amazon EC2 l

AWS Identity and Access Management (IAM)

Note: USM Anywhere uses us-east-1 as a default region in the amazon-aws app. As a result, you might want to verify whether or not your sensors are communicating with us-east-1, even if you have never deployed to that region.

67 USM Anywhere™ Deployment Guide

Deploying the AWS Sensor

Installation Prerequisites

Before you install the AWS sensor, make sure you have the following prerequisites available:

Prerequisites Description

AWS CloudFormation template, available from

AlienVault

The CloudFormation template automatically creates all required AWS resources for deployment, including an

IAM Role and instance profile for use by the

USM Anywhere instance.

Privileged user account on AWS

For details, see

Task 1: Receive USM Anywhere

Download Link and Activation Code

To deploy the CloudFormation template you must have a privileged user account with permissions to create

Identity and Access Management (IAM) resources.

Multiple Accounts or VPCs

If you have multiple AWS accounts, you must deploy the AWS sensor in each AWS account that you want to monitor.

Amazon VPC enables you to launch AWS resources into a virtual network that you've defined. A single sensor can monitor an entire AWS account, even when it contains multiple virtual private clouds (VPCs).

Note: If you intend to use the USM Anywhere vulnerability scanner with the AWS sensor, you must allow traffic from the sensor and the target instance you are scanning. You can usually accomplish this by using VPC peering.

Deploying the AWS Sensor

After you review the requirements and make sure that your AWS environment is configured as needed, you can deploy the AWS sensor. Using the CloudFormation Template provided by

AlienVault, you can automatically deploy USM Anywhere as a service into your environment.

You will need the following resources to complete this process: l

Link to a USM Anywhere page where you can download the sensor template. (AlienVault also sends an email with this information.) l

Product authentication code l

License key

USM Anywhere™ Deployment Guide 68

Deploying the AWS Sensor

The following procedure describes how to launch the AWS sensor when provisioning the

USM Anywhere service for the first time. In this process, you launch the USM Anywhere product from the AWS console using the AWS CloudFormation template provided by AlienVault.

Important: If you are deploying the sensor in a VPC, make sure that the target VPC subnet has the Enable auto-assign public IPv4 address option enabled prior to creating the

CloudFormation stack. For detailed information, refer to the AWS documentation .

To create a new sensor in the AWS console

1. Under Management Tools, click CloudFormation.

2. Click Create New Stack.

This launches the AWS Create Stack wizard.

3. On the Select Template page, scroll to the Choose a template section and select Specify an

AWS S3 template URL.

69 USM Anywhere™ Deployment Guide

Deploying the AWS Sensor

4. In another browser tab or window, open the sensor download link you received from AlienVault.

This page provides two AWS sensor templates. Click the template that is correct for your environment and copy the displayed URL: l

VPC l

Non-VPC (EC2 Classic)

5. Return to the AWS console and paste the link it in the text box for the selected template option.

6. Click Next.

7. On the Specify Details page, enter a name in the Stack name text box.

The name must be one word. Use hyphens, if desired. For example, you could call the stack

"USM-sensor-1".

8. Set the Parameters.

Note: The volume size should be prefilled. You can leave this setting at the default value.

In the USM Anywhere Sensor Name text box, enter the same name you used for the stack.

In the Key Name list, select the PEM file that you normally use for an ssh connection into

AWS .

Specify the HTTP Access Range and SSH Access Range.

Click Next when the stack details are complete.

9. (VPC templates only) Select the appropriate VPC ID and Subnet ID, then click Next.

10. (Optional) On the Options page, set tags for the instance and click Next.

USM Anywhere™ Deployment Guide 70

Deploying the AWS Sensor

11. On the Review page, select the checkbox at the bottom of the page, next to the statement:

I acknowledge that AWS CloudFormation might create IAM resources.

12. Click Create.

13. In the Create stack page, confirm that your newly-created stack status reads:

CREATE_IN_PROGRESS

Stack creation typically takes about 15 minutes. When the stack build is complete, you see the following confirmation:

CREATE_COMPLETE

14. After your new stack is complete, click the Outputs tab at the bottom of the Create Stack table and click the URL link (displayed in blue) at bottom of the page.

This redirects you to the Instances page in the AWS console, where you can access the public

IPv4 address of your deployed sensor.

15. Make note of the IPv4 Public IP address for your deployed sensor instance because you will need this information to complete the sensor registration in USM Anywhere.

USM Anywhere™ Deployment Guide

AWS Sensor Connection to USM Anywhere

You can refer to the AWS documentation for more information about the public IPv4 address.

AWS Sensor Connection to USM Anywhere

After obtaining the IP address of your USM Anywhere web portal, you must provision your

USM Anywhere instance from the AlienVault Secure Cloud. This IP address is provided when you create the stack in your AWS account.

When you access the web UI, you must register the sensor using the initial Authentication Code

Wizard to complete the sensor deployment.

USM Anywhere™ Deployment Guide 72

AWS Sensor Connection to USM Anywhere

To register your sensor and provision the instance

1. Open a web browser and enter the IP address.

2. Click Start Setup to start the process of connecting to the USM Anywhere Sensor.

Note: You'll also receive an email from AlienVault with the link in it.

USM Anywhere™ Deployment Guide

AWS Sensor Connection to USM Anywhere

Configure the Initial Login Credentials

When you link to a newly-provisioned USM Anywhere instance, you must configure the password for the initial user account, which is the default administrator as defined in your subscription.

To configure login credentials

1. Click the link in the welcome message.

This displays a prompt to set the password to use for the default administrator of USM

Anywhere.

2. Enter the password, and again to confirm.

USM Anywhere requires a minimum password length of eight characters, with a maximum length of 128 characters. The password must combine numerical digits (0-9), uppercase letters

(A-Z), and lowercase letters (a-z). Special characters, such as hyphen (-) and underscore (_) are supported, but optional.

Note: USM Anywhere passwords expire after 90 days. When your password expires,

USM Anywhere enforces the password change when you next log into the system using the current (now expired) password. A new password must be different than the previous four passwords.

3. Click Save & Continue.

4. When the login page appears, enter the password you just set, select acceptance of the terms of service, and click Login.

USM Anywhere™ Deployment Guide 74

AWS Sensor Connection to USM Anywhere

Verify That the USM Anywhere Sensor Is Running

It's a good idea to verify that the USM Anywhere Sensor is running. It also gives you the chance to watch the sensor actively working to find all of your assets and to record events from the start.

Note: Make sure to verify that the AWS sensor is running before performing configuration. You can keep one instance with the WELCOME TO USM ANYWHERE page in the background while you perform the verification on a different instance.

To verify the new USM Anywhere Sensor

1. From the USM Anywhere menu bar, select SETTINGS > DEPLOYMENT.

You should now see your sensor in the Sensors section of the Deployment page.

After a few minutes, USM Anywhere locates your assets and starts registering events.

2. Review these in two locations: l

From the primary task bar, select ENVIRONMENT > ASSETS.

From the primary task bar, select ACTIVITY > EVENTS.

Note: It could take up to six minutes before events appear. Make sure to refresh your browser from time to time to display the current data.

This example shows the types of events USM Anywhere might generate following an asset scan.

For more information about using the alarms and events pages in USM Anywhere, see the

USM Anywhere User Guide.

75 USM Anywhere™ Deployment Guide

Completing the AWS Sensor Setup

About Accessing the Setup Wizard

The Setup Wizard launches under the following circumstances: l

When you first log into the USM Anywhere web interface and see the WELCOME TO USM

ANYWHERE page, click Get Started.

If you configured a first sensor, but did not complete the setup and then logged out, the Setup wizard launches to remind you to finalize configuration on the remaining sensors when you log in again.

When you select SETTINGS > DEPLOYMENT and click the configure icon for the sensor.

Any unconfigured sensor displays a red x in the Configuration column.

USM Anywhere™ Deployment Guide 76

Completing the AWS Sensor Setup

Configuring the Sensor in the Setup Wizard

The AMAZON WEB SERVICES CONFIGURATION page provides information about the asset discovery that occurs upon the initial deployment of the, summarizing the number of instances, instance types, and regions in your environment .

Click Next to proceed with the Setup Wizard and complete additional configuration on each page.

USM Anywhere™ Deployment Guide

Completing the AWS Sensor Setup

AWS LOG COLLECTION

USM Anywhere automatically discovers a number of out-of-box logs as long as you have enabled them within your AWS subscription. For more information about these logs and how they function within the AWS environment, see

AWS Log Discovery in USM Anywhere

1. Enable the AWS S3 and CloudWatch out-of-box log collection jobs.

Locate the jobs you want to enable and click the disabled icon ( green ( ).

). This turns the icon

Note: You can also enable CloudTrail, ELB Access, and other security logs. However, make sure you've enabled these first on your AWS account.

2. Click Next.

LOG MANAGEMENT

On the LOG MANAGEMENT page, you see the IP addresses of the assets you added during the asset discovery configuration. You also see the port number. (The port is the same for all

USM Anywhere Sensors.)

USM Anywhere collects third-party device data through syslog on port 514 by default. To configure any third-party devices to send data to USM Anywhere, you must give them the IP address of your

USM Anywhere Sensor and the port number.

USM Anywhere™ Deployment Guide 78

Completing the AWS Sensor Setup

Make sure that you've granted the necessary permissions for your operating system to allow

USM Anywhere to access its logs. You can also integrate a wide variety of plugins to send log data over syslog to the USM Anywhere Sensor.

To find out how to configure your operating system and supported third-party devices to forward syslog log data, see the following related topics: l

Log collection from a Linux System —

Log collection from a Windows System —

Log collection from other devices using a plugin —

complete the sensor setup

Note: Because the log scan can take some time, you may not immediately see all the automatically discovered log sources right after deploying the first sensor.

When you've finished the log collection setup and integrated any needed plugins, verify that the data transfer is occurring.

Click Next when this step is complete.

USM Anywhere™ Deployment Guide

Completing the AWS Sensor Setup

THREAT INTELLIGENCE

On the Threat Intelligence page, you can connect the deployed sensor to your AlienVault®

When you configure the OTX connection, the USM Anywhere Sensor receives raw pulse data from

OTX. After the deployed sensor starts to receive this data, USM Anywhere correlates that data and generates related OTX pulse and IP Reputation-related security events and alarms when it detects

IOCs interacting with assets in your environment. These events are displayed in the Open Threat

Exchange dashboard, which is available from the DASHBOARDS menu.

1. Log into OTX and open the API page ( https://otx.alienvault.com/api/ ).

2. In the DirectConnect API Usage panel, click the Copy ( ) icon to copy your unique

OTX connection key.

3. Return to the Threat Intelligence page of the USM Anywhere Sensor setup wizard and paste the value in the OTX Key text box.

USM Anywhere™ Deployment Guide 80

Completing the AWS Sensor Setup

4. Click Validate OTX Key.

With a successful validation of the key, the status at the top of the page changes to Valid

OTX key.

Click Next when this task is complete.

USM Anywhere™ Deployment Guide

Adding Another Sensor to Other AWS Accounts

SETUP COMPLETE

The Congratulations! page summarizes the status of your configuration.

Click Start Using USM Anywhere, which takes you to the Overview dashboard.

Next...

Now's a great time to run a vulnerability scan. You can learn how to run a vulnerability scan by going to Vulnerability Assessment in the

USM Anywhere User Guide .

Adding Another Sensor to Other AWS Accounts

After you set up your initial USM Anywhere service, you can generate the license key for any new sensor you intend to add for other AWS accounts from within the USM Anywhere web UI.

To add an additional USM Anywhere Sensor

1. On the USM Anywhere primary task bar, select SETTINGS >DEPLOYMENT.

2. Click NEW SENSOR.

A new sensor authentication code displays in the dialog.

USM Anywhere™ Deployment Guide 82

Adding Another Sensor to Other AWS Accounts

3. Copy the code to the clipboard or another location for use later and keep the instance in the background.

4. Create the sensor stack in your AWS account, as described in

Deploying the AWS Sensor

5. When you get to the WELCOME TO USM ANYWHERE SENSOR SETUP! page, it prompts you to provide the information for registering the additional sensor with your

USM Anywhere instance: l

Enter a Sensor Name and Sensor Description.

Paste the sensor authentication code you copied into the field with the key icon.

Copy the URL of your existing USM Anywhere web portal and paste it into the field with the computer monitor icon.

For example, if the subdomain with which you registered with AlienVault was "example123," the URL would be example123.alienvault.cloud

83 USM Anywhere™ Deployment Guide

Adding Another Sensor to Other AWS Accounts l

Click Start Setup.

A progress screen displays the following message:

Connecting USM Anywhere Sensor

When the connection is complete, a Welcome page appears:

6. Click the link to open the USM Anywhere web UI.

Upon login, this displays the USM ANYWHERE SENSOR CONFIGURATION page with the connected sensor listed in the page.

USM Anywhere™ Deployment Guide 84

Enabling syslog Connections in an AWS VPC

7. Click Configure to

If you do not want to complete the sensor setup immediately, you can click Start Using

USM Anywhere at the bottom of the page. However, you must complete the sensor setup before you can use it.

Note: Although you can wait to configure the new sensor at a more convenient time, we strongly recommend that you do so now.

Enabling syslog Connections in an AWS VPC

An AWS sensor that is deployed to a virtual private cloud (VPC) automatically listens for syslog packets on UDP port 514, but you must enable access to it. This allows the other hosts in your network to send data to the sensor. You enable this access by opening this port using the AWS

Security groups that were created by the CloudFormation template that you

used to deploy the sensor

The AWS Security Groups

These three AWS Security Groups help control network connectivity between the instances: l

USMConnectionSG — Accepts incoming HTTP, HTTPS, and SSH connections from the CIDR block you specified when you completed the CloudFormation template parameters.

These connections are only required to enable remote sensor management, and to connect to the web UI during deployment and setup.

USMServicesSG — Accepts incoming UDP connections on port 514 from any VM instance in the USMBaseSG.

USMBaseSG — Does not have inbound nor outbound rules, nor is it assigned to the sensor.

It exists solely as a convenience, so that you can assign it to VMs for connection to UDP over port

514 on the sensor as specified in the USMServicesSG.

USM Anywhere™ Deployment Guide

AWS Log Discovery in USM Anywhere

Open UDP Port 514

You can open UDP port 514 to receive syslog packet transmissions from the AWS console using any one of the following methods: l

Assign the USMBaseSG Security Group to the selected VMs by navigating to Networking >

Change Security Groups action. (You can also do this through the AWS CLI.) l

Add the default Security Group from your VPC to the USMServicesSG; this allows all the VMs in that Security Group to send to port 514 UDP.

Put the AWS sensor in the default Security Group from your VPC; this gives all of the VMs in the local VPC full access to all ports on the sensor.

AWS Log Discovery in USM Anywhere

With a deployed AWS sensor, USM Anywhere automatically discovers a number of out-of-box

AWS logs when you have enabled them within your AWS subscription.

You can enable or disable log collection for these logs from the AWS sensor Setup Wizard (see

AWS LOG COLLECTION ) or within the USM Anywhere Job Scheduler (see

Enabling Standard

Log Collection and Scan Jobs

CloudTrail Logs

AWS CloudTrail provides a complete audit log for all actions taken with the Amazon API, either through the web interface, the CLI, or an SDK.

Ongoing monitoring of this log gives you visibility of end-user and automated actions in your environment. This helps you quickly detect abuse cases and security incidents, such as a user trying to make changes inconsistent with their privileges to an AWS account.

USM Anywhere automatically detects AWS CloudTrail, and retrieves your CloudTrail logs across all regions by default. USM Anywhere also provides you the credentials to access your CloudTrail logs securely.

Note: If you choose not to enable AWS CloudTrail, USM Anywhere processes all stored logs at initial start up.

For information about enabling AWS CloudTrail, see the vendor documentation at http://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html.

Elastic Load Balancing Logs

The AWS sensor automatically detects AWS Elastic Load Balancing (ELB) logs after you've enabled them in AWS.

Unlike other AWS log collection jobs, you never schedule a new ELB job. After USM Anywhere examines your ELB logs, it creates jobs according to the logging configuration. After you enable these logs in USM Anywhere, it analyzes them and displays events.

USM Anywhere™ Deployment Guide 86

AWS Log Discovery in USM Anywhere

Elastic Load Balancing supports two types of load balancers: l

Application Load Balancer

An Application Load Balancer functions at the application layer, serving as a single point of contact for clients. This increases the availability of an application. The Application Load Balancer

Access Logs provide insight into who is accessing your applications. They also help you identify common abuse patterns and use of automated hacking tools, such as web application scanners.

To learn how to enable Application Load Balancer logging in AWS, see the Amazon documentation .

Classic Load Balancer

AWS Classic Load Balancer (formerly Elastic Load Balancer) logs provide an easy, yet effective way to monitor HTTP traffic for threats. The AWS Classic Load Balancer Access Logs provide insight into who is accessing your web resources. They also help you identify common abuse patterns and use of automated hacking tools, such as web application scanners.

To learn how to enable Classic Load Balancer logging in AWS, see the Amazon documentation .

Important: You must enable Classic Load Balancer logs for every ELB that you want to monitor.

CloudWatch Logs

AWS CloudWatch monitors applications, such as CloudTrail, and systems using log data, aggregating and storing application logs. This utility lets you transport log files from your running

Access Log

instances to a place where USM Anywhere can access them without your having to change any network access settings.

CloudWatch Logs are useful, because you can easily configure them to process additional metadata with the log files. They also make moving log files around EC2 easy.

Important: CloudWatch streams should be separated from each other by plugin type.

AWS S3 and CloudWatch locations can automatically generate events based on CloudTrail, S3,

ELB Access, and other security logs.

Follow the appropriate procedures for your operating system to configure the CloudWatch Logs

Agent to use the

EC2Config service: l

MS Windows — http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/send_logs_to_ cwl.html

Linux — http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html

87 USM Anywhere™ Deployment Guide

AWS Log Discovery in USM Anywhere

When setting up CloudWatch, you should configure the system logs to go to an AWS Log Group called Windows-System-Logs , shown in boldface in the following list: l

IIS-Logs — "IIS Logs" plugin l

Apache-Access-Logs — "Apache" plugin l

Linux-Audit-Logs — "Linux Auditd" plugin l

Linux-Auth-Logs — "Linux SUDO" plugin l

OSQuery-Logs — "Osquery" plugin l

Windows-System-Logs — "AWSWindows" plugin

This is because it already exists as a scheduled task in the AWS LOG COLLECTION page of the

AWS sensor Setup wizard and the USM Anywhere Scheduler. USM Anywhere finds and processes the logs automatically with the

AWS Windows plugin .

Make sure to keep the log types the same within a given log group. The scheduled CloudWatch task in USM Anywhere assumes that all streams within a given group should be parsed using the same plugin, as listed here.

S3 Access Logs

Amazon Simple Storage Service (Amazon S3) is object storage with a simple web service interface that you can use to store and retrieve any amount of data from anywhere on the web. Organizations running an AWS environment typically use it as the primary storage for their cloud-native applications, as a bulk repository, as a target for backup and recovery, and as a log-term archive location.

Amazon S3 has the ability to provide complete access logs for all actions taken in an S3 bucket.

When you enable this capability, it gives you insight into who is accessing the data, and what actions are being taken.

To learn how to enable S3 Access Logging, see Amazon's documentation .

Note: In AWS, you must enable S3 Access Logging in every S3 bucket that you want to monitor.

Moving Logs from an EC2 Instance to an S3 Bucket

It can often be difficult in Amazon EC2 to create direct network connections between isolated parts of your environment. Amazon S3 provides a convenient way to move application logs from an EC2 instance to an S3 bucket. You then configure the AWS sensor to retrieve and process the log files.

You'll want to synchronize logs from your instance with an Amazon S3 bucket. There are multiple ways to do this. The easiest method is to use the AWS CLI documented by Amazon . You then create a script like the following example and configure it to run periodically as a cron job.

aws s3 sync "<path_to_log>" "S3://<bucket_name>/<storage_path>/"

For information about how to create an S3 Access collection job in USM Anywhere, see

Creating a

New AWS S3 Access Collection Job .

USM Anywhere™ Deployment Guide 88

Creating a New CloudWatch Collection Job

The CloudWatch utility lets you transport log files from your running

S3 Access Logs

instances to a place where USM Anywhere can access them without your having to change any network access settings. CloudWatch Logs are useful, because you can easily configure them to process additional metadata with the log files. They also make it easy to move log files around EC2.

If you want USM Anywhere to configure a log collection job with your own parameters, use this procedure to create a new collection job.

Note: Before you create a new CloudWatch log collection job, you must have CloudWatch enabled in your AWS environment. For more information, see

CloudWatch Logs

To create new CloudWatch log collection job

1. Go to SETTINGS >SCHEDULER.

2. In the left navigation list, click Log Collection.

3. Click Create Log Collection Job.

Note: If you recently deployed a new sensor, it can take from 10 to 20 minutes for the various log sources to be discovered. After USM Anywhere has discovered the logs, you must still manually enable them before the system pulls them in.

4. Enter the Name and Description for the job.

The description is optional, but it is a best practice to provide this information so that others can easily understand what it does.

5. Use the Select Sensor option to select the deployed AWS sensor.

6. In the Select App option, select Amazon Web Services.

7. In the App Action option, select Monitor CloudWatch.

USM Anywhere™ Deployment Guide

Creating a New CloudWatch Collection Job

8. Enter the Region Name, Group Name, and Stream Name information for your AWS account.

9. In Source Format, select either of the following log formats: l syslog — Standard format for transmitting log data to USM Anywhere l raw — Not applicable

USM Anywhere transfers CloudWatch log data to an S3 bucket automatically. If you have raw data that you have collected using another tool, you can either select raw here or use an

S3 Log Collection job for this purpose instead.

USM Anywhere™ Deployment Guide 90

Creating a New CloudWatch Collection Job

Important: CloudWatch streams should be separated from each other by plugin type.

10. (Raw source only) From the Plugin Name list, select the plugin that corresponds to the incoming data.

11. Set the Schedule to specify when USM Anywhere runs the job.

First, choose the increment as Hour, Day, Week, Month, or Year. Next, set the interval options for the increment. The selected increment determines the available options.

For example, on a weekly increment you can select the days of the week to run the job.

USM Anywhere™ Deployment Guide

Creating a New AWS S3 Access Collection Job

Or, on a monthly increment you can specify a specific date or a day of the week that occurs within in the month.

To finish, set the Start time. This is the time that the job starts at the specified interval. It uses the time zone configured for your USM Anywhere instance (default is UTC).

12. Click Save.

Creating a New AWS S3 Access Collection Job

Before you can create a new AWS S3 Access collection job, you must have previously enabled it in

AWS. For more information about these logs, see

S3 Access Logs .

Note: In AWS, you must enable S3 Access Logging in every S3 bucket that you want to monitor.

USM Anywhere™ Deployment Guide 92

Creating a New AWS S3 Access Collection Job

To create a new S3 Access Collection Job

1. Go to SETTINGS >SCHEDULER.

2. In the left navigation list, click Log Collection.

3. Click Create Log Collection Job.

4. Enter the Name and Description for the job.

The description is optional, but it is a best practice to provide this information so that others can easily understand what it does.

5. Use the Select Sensor option to select the deployed AWS sensor.

6. In the Select App option, select Amazon Web Services.

7. In the App Action option, select Monitor S3 Bucket.

93 USM Anywhere™ Deployment Guide

Creating a New AWS S3 Access Collection Job

8. Enter the Bucket Name and Path.

The bucket name is simply the name of the S3 bucket as configured in your AWS account, such as

DevBucket

The path is the path prefix within the S3 Bucket, such as

AWSLOGS/3987783

. This does not include the bucket name.

9. In Source Format, select either of the following log formats: l syslog — Standard format for transmitting log data to USM Anywhere l raw — Not applicable

USM Anywhere™ Deployment Guide 94

Creating a New AWS S3 Access Collection Job

10. (Raw source only) From the Plugin Name list, select the plugin that corresponds to the incoming data.

11. Set the Schedule to specify when USM Anywhere runs the job.

First, choose the increment as Hour, Day, Week, Month, or Year. Next, set the interval options for the increment. The selected increment determines the available options.

For example, on a weekly increment you can select the days of the week to run the job.

Or, on a monthly increment you can specify a specific date or a day of the week that occurs within in the month.

USM Anywhere™ Deployment Guide

Creating a New AWS S3 Access Collection Job

To finish, set the Start time. This is the time that the job starts at the specified interval. It uses the time zone configured for your USM Anywhere instance (default is UTC).

12. Click Save.

13. Restart the AWS sensor instance as appropriate to the AWS platform, so that it detects the new configuration.

USM Anywhere™ Deployment Guide 96

USM Anywhere Sensor Deployment on Microsoft Azure

This topic discusses the following subtopics:

About USM Anywhere Deployment on Azure

Requirements for USM Anywhere Sensor Deployment on Azure

Deploying the USM Anywhere Sensor from the Azure Marketplace

Deploying the USM Anywhere Sensor in the Web Interface

Creating an Application and Obtaining Azure Credentials

Completing the Azure Sensor Setup

Creating a New Azure Collection Job

USM Anywhere™ Deployment Guide 97

About USM Anywhere Deployment on Azure

If your organization uses multiple subnets to allow communication between headquarters and remote offices, we recommend that you deploy a sensor to each.

Alternatively, you can deploy a USM Anywhere Sensor in a single virtual network. If you deploy a sensor to only a single virtual network in your Azure subscription, you'll see Azure Insight logs for the entire subscription.

USM Anywhere automatically discovers your use of the following logs without the need for enablement on the Azure subscription side, as long as you have given the Azure resource subscription contributor-level permissions: l

Azure REST Monitor (formerly Azure Insight) logs l

Azure SQL Server logs

Note: USM Anywhere only collects SQL Server logs stored as tables. It does not collect logs stored as Binary Large OBjects (BLOB)s.

Azure IIS logs l

Azure Windows logs l

Azure Security Alerts

Requirements for USM Anywhere Sensor Deployment on Azure

To ensure that you can successfully monitor all of your Azure resource groups, using the

USM Anywhere Sensor, you should possess the following.

AWS Sensor Requirements l

An Azure account with privileges in the resource group or subscriptions in which you want to install the USM Anywhere Sensor l

Within the Azure portal, you should already have the following: o

Administrative access to Active Directory within Azure

This allows you to create an application in which to install resource groups or subscription for monitoring.

A virtual network inside the resource group o

A subnet inside the virtual network o

A storage account

98 USM Anywhere™ Deployment Guide

Deploying the USM Anywhere Sensor from the Azure Marketplace

Azure Resource Groups Monitoring Requirements

You can deploy one USM Anywhere Sensor to monitor all of your Azure resource groups. To do this, you must assign the application you create to the entire subscription.

Application Service Dependencies

The following is a list of outbound IP addresses and ports used by USM Anywhere for its Azure sensor deployment.

Outbound Ports and Protocols

A deployed USM Anywhere Sensor requires opening the firewall for communication with USM

Anywhere in the cloud for the following ports and protocols: l

SSL over TCP on port 7100 l

HTTP over port 80 for product updates l

Amazon Web Services IPs over ports 443 and 7100 l

Access to

*.alienvault.cloud

over port 443 l

SSH over port 22 for USM Anywhere Remote Support

Inbound Ports

You do not need to open any inbound ports in the firewall of your local network, because the USM

Anywhere Sensor receives no inbound connections from outside the firewall.

When you configure plugins to forward log data to the USM Anywhere Sensor from within your local network, the sensor receives inbound connections through port 514 over syslog.

Deploying the USM Anywhere Sensor from the Azure Marketplace

To deploy a USM Anywhere Sensor for Azure

1. Go to https://www.alienvault.com/products/usm-anywhere/sensor-downloads and click the

Sensor Download arrow next to Azure.

This takes you to the Microsoft Azure Login page.

2. Click your username and, on the next page, type your password and click Sign in.

3. On the USM Anywhere License page, review the details of the license, then click Create.

USM Anywhere™ Deployment Guide 99

Deploying the USM Anywhere Sensor from the Azure Marketplace

100

This takes you to the Create Virtual Machine Basics page.

4. Complete the following fields within the Basics blade of the page: a. Name — Name you want to give the virtual machine for your USM Anywhere Sensor.

b. VM disk type — Indicate whether you use HDDs or SSDs.

c. User name— Type your SSH username. For access to the AlienVault console, this must be sysadmin

d. Authentication type — Indicate whether you use an SSH Public key or a password for SSH access.

e. Subscription — Select the subscription into which USM Anywhere Sensor should be installed.

f. Resource Group — Indicate whether you want to install the USM Anywhere Sensor into an existing resource group or into a new resource group. If new, type a unique name.

USM Anywhere™ Deployment Guide

Deploying the USM Anywhere Sensor from the Azure Marketplace g. Location — If you are using a new resource group, indicate the region for the

USM Anywhere Sensor. Otherwise, leave it blank.

h. Click OK.

5. In the Choose a Size blade, select the instance size of your virtual machine.

Although you can select any size, AlienVault recommends the following instance sizes: l

HDD instances — D2 standard l

SSD instances — DS2 premium

6. Click Select.

7. In the Settings blade, complete the following fields to indicate storage and network preferences: a. Storage Account — Select the storage account that the USM Anywhere Sensor should use.

If HDD was selected, a standard storage account will be requested.

If SSD was selected, a premium storage account will be requested.

b. Network — Indicate the name of the network where the USM Anywhere Sensor should be installed.

Make sure you install the USM Anywhere Sensor in the network where the assets reside that you want to monitor.

c. Extensions — Leave blank.

d. High availability — Leave blank.

e. Monitoring — Leave it disabled unless you want to store USM Anywhere Sensor logs for monitoring purposes.

8. Click OK.

9. On the Summary blade, review the values you previously entered, then click OK.

10. On the Purchase blade, review the cost summary.

USM Anywhere™ Deployment Guide 101

Deploying the USM Anywhere Sensor in the Web Interface

102

11. Click Purchase.

After you click Purchase, the deployment of the USM Anywhere Sensor starts. This can take up to six minutes.

12. After deployment finishes, access the public IP by reviewing the virtual machine summary.

Paste this IP address into a browser window to launch the USM Anywhere web interface.

Deploying the USM Anywhere Sensor in the Web Interface

Launching the First USM Anywhere Sensor in the Web Interface

Configuring Login Credentials

Adding Another USM Anywhere Sensor to Your Azure Subscription

Launching the First USM Anywhere Sensor in the Web Interface

This procedure gives you access to the sensor through the USM Anywhere web interface, where you initiate a connection to the cloud.

You perform this procedure after

deploying

the USM Anywhere Sensor within your Azure subscription.

USM Anywhere™ Deployment Guide

Deploying the USM Anywhere Sensor in the Web Interface

To set up the USM Anywhere Sensor for Azure in the web interface

1. After deployment finishes, locate the public IP of the virtual machine by reviewing the virtual machine summary.

You'll need this IP address in the next procedure.

Configuring Login Credentials

Configure the Initial Login Credentials

When you link to a newly-provisioned USM Anywhere instance, you must configure the password for the initial user account, which is the default administrator as defined in your subscription.

To configure login credentials

1. Click the link in the welcome message.

This displays a prompt to set the password to use for the default administrator of USM

Anywhere.

2. Enter the password, and again to confirm.

USM Anywhere requires a minimum password length of eight characters, with a maximum length of 128 characters. The password must combine numerical digits (0-9), uppercase letters

(A-Z), and lowercase letters (a-z). Special characters, such as hyphen (-) and underscore (_) are supported, but optional.

USM Anywhere™ Deployment Guide 103

Deploying the USM Anywhere Sensor in the Web Interface

Note: USM Anywhere passwords expire after 90 days. When your password expires,

USM Anywhere enforces the password change when you next log into the system using the current (now expired) password. A new password must be different than the previous four passwords.

3. Click Save & Continue.

4. When the login page appears, enter the password you just set, select acceptance of the terms of service, and click Login.

104

Adding Another USM Anywhere Sensor to Your Azure Subscription

To add an additional USM Anywhere Sensor

1. From the USM Anywhere primary task bar, select SETTINGS > DEPLOYMENT.

2. Click NEW SENSOR.

A new sensor authentication code displays in the SENSOR AUTHENTICATION CODES of the page.

3. Copy the key to the clipboard and keep the instance in the background for use later on in this procedure.

4. Repeat the steps for

Deploying the USM Anywhere Sensor from the Azure Marketplace .

5. Repeat the steps in this topic for

Launching the First USM Anywhere Sensor in the Web Interface , but in step 6 of that procedure, paste the Activation key that you saved in step 3 of this pro-

cedure because you will be prompted for these. See

Creating an Application and Obtaining

Azure Credentials .

USM Anywhere™ Deployment Guide

Creating an Application and Obtaining Azure Credentials

About Creating an Application and Obtaining Azure Credentials

Obtaining the Azure Credentials Manually

About Creating an Application and Obtaining Azure Credentials

Before you can use USM Anywhere to monitor your Azure subscription, you must create an application that grants permission to USM Anywhere to fetch data using the Azure SDK and Azure

Rest API.

Important: You must have global administrator privileges to create an application and obtain credentials.

If you're a Windows OS user, you can do this in two ways: l

Using a Powershell script

available through the USM Anywhere Setup wizard

Manually within your Azure subscription.

If you're not a Windows OS user, you'll need to generate these manually from your Azure subscription.

The credentials are:

Azure Credential azure_tenant_id azure_subscription_id azure_application_id azure_application_key

USM Anywhere Field Name

Azure Tenant ID

Azure Subscription ID

Azure Application ID

Azure Application Key

Obtaining the Azure Credentials Manually

Use the following procedure to obtain Azure credentials if your operating system is either Linux or macOS.

USM Anywhere™ Deployment Guide 105

Creating an Application and Obtaining Azure Credentials

Obtaining the Azure Subscription ID

To get the Azure subscription ID

1. Log into the Microsoft Azure Portal ( https://portal.azure.com

2. From the Azure Dashboard, select Subscriptions.

3. From the Subscription page, copy your Subscription ID, and save it somewhere where it won't be overwritten.

106 USM Anywhere™ Deployment Guide

Creating an Application and Obtaining Azure Credentials

Creating the Application

To create the application and obtain the remaining Azure credentials (tenant ID, application ID, and application key), you must complete Microsoft Azure's standard procedure for its new portal . If you don't perform this task, you'll be unable to deploy your USM Anywhere Sensor for Azure.

Associating the Application to the Entire Subscription

If you want to use USM Anywhere to monitor all of your Azure resources, you can associate it with your Microsoft Azure subscription as a whole.

To associate the application with the entire subscription

1. Log into the new Microsoft Azure portal ( https://portal.azure.com

2. Go to More Services > Subscriptions and double-click yours.

3. From the <name-of-your-subscription blade>, select Access control (IAM).

This reveals a new blade, showing the roles and permissions that exist.

4. At the top of the blade, click Add, then select the Contributor role.

This allows users to fetch new Azure logs.

5. Select the Service principal you created previously to assign the role to the subscription. Then click Save and OK.

The system responds with the message:

Added user. <User_names> were added as Contributor for <name-of-yoursubscription>.

USM Anywhere™ Deployment Guide 107

Completing the Azure Sensor Setup

After you initialize a new USM Anywhere Sensor, you must configure it in the setup wizard. As part of configuration, you can schedule applications to perform specific actions, like running an asset discovery scan or collecting security events from a predefined cloud storage location.

Accessing the Setup Wizard

The Setup Wizard launches under the following circumstances: l

When you first log into the USM Anywhere web interface and see the WELCOME TO USM

ANYWHERE page, click Get Started.

If you configured a first sensor, but did not complete the setup and then logged out, the Setup wizard launches to remind you to finalize configuration on the remaining sensors when you log in again.

When you select SETTINGS > DEPLOYMENT and click the configure icon for the sensor.

Any unconfigured sensor displays a red x in the Configuration column.

Configuring the Azure Sensor in the Setup Wizard

The first time you log into the web interface from the WELCOME TO USM ANYWHERE web page, the Setup Wizard prompts you to complete the configuration of the first deployed sensor. Thereafter, you can use the wizard to add an additional sensor or to change a sensor configuration.

From the WELCOME TO USM ANYWHERE page (not shown), click Get Started. Within the

Setup Wizard, complete the configuration on each page.

108 USM Anywhere™ Deployment Guide

Completing the Azure Sensor Setup

AZURE CREDENTIALS

To complete the Azure sensor configuration, you must obtain Azure API credentials for the subscription that you want USM Anywhere to monitor. Select the option on the

AZURE CREDENTIALS page that matches your current Azure credential creation status: l

If you already generated your Azure credentials, click Yes, I have my Azure credentials and am ready to enter them.

If you don't yet have your Azure credentials, click No, I don't have my Azure credentials and need to create them.

If you're not sure, click I am not sure. Show me how to create my Azure credentials.

USM Anywhere™ Deployment Guide 109

Completing the Azure Sensor Setup

If you select No or I am not sure, the page provides options for two creation methods:

If you select Yes, follow the steps in

Configuring the Azure Credentials After Manual Credential

Generation .

Obtaining the Azure Credentials for Windows Users

This procedure is for Windows users who want to use the Powershell script to generate their credentials for sensor configuration.

1. Select Create credentials automatically using a Powershell script (Recommended).

The page automatically launches a download of the Powershell script. You can use the browser tools to save the file to the appropriate location on your system.

110 USM Anywhere™ Deployment Guide

Completing the Azure Sensor Setup

2. Run the script as administrator on your Windows operating system.

Note: If you have multiple Azure subscriptions, the script prompts you to identify which one you want USM Anywhere to monitor.

When the script finishes it creates a text file that saves to your Desktop.

3. In USM Anywhere, drop the Azure credentials text file onto the page displayed or click the select USM_Anywhere_Azure_Credentials.txt from your desktop link to locate, select, and upload the file.

USM Anywhere™ Deployment Guide 111

Completing the Azure Sensor Setup

112

4. Verify that the status at the top of the page displays the message:

Valid Credentials

Creating the Azure Credentials Manually

1. Select Learn how to create Azure credentials manually.

This opens the

Creating an Application and Obtaining Azure Credentials

page in a new browser tab or window.

2. Follow the instructions for creating the needed credentials.

3. Return to USM Anywhere, then click the Back button to display the first to the AZURE

CREDENTIALS page.

Configuring the Azure Credentials After Manual Credential Generation

This procedure is for non-Windows users who generated their Azure credentials manually and who are ready to configure the sensor.

1. Select the Yes option, and in the next page click the Enter previously created Azure credentials manually link at the bottom of the page.

2. Enter the Azure API credentials you

generated in the Azure console

into the appropriate fields.

USM Anywhere™ Deployment Guide

Completing the Azure Sensor Setup

3. Click Save Credentials.

4. Verify that the status at the top of the page displays the message:

Valid Credentials

When the credentials are configured, click Next.

The wizard displays the next page in the setup process, AZURE CONFIGURATION.

USM Anywhere™ Deployment Guide 113

Completing the Azure Sensor Setup

AZURE CONFIGURATION

After you've successfully configured the Azure credential, the AZURE CONFIGURATION page appears. This page summarizes the number of Azure virtual machines (VMs), resource groups, and

VM sizes in your environment.

114

Click Next.

The wizard displays the next page in the setup process, AZURE LOG COLLECTION.

AZURE LOG COLLECTION

The AZURE LOG COLLECTION page displays the following Azure logs discovered by

USM Anywhere in your environment: l

Azure REST Monitor (formerly Azure Insight) l

Azure SQL Server logs l

Azure IIS logs l

Azure Windows logs l

Azure Security Alerts

Note: USM Anywhere only collects SQL Server logs stored as tables. It does not collect logs stored as Binary Large OBjects (BLOB)s.

USM Anywhere™ Deployment Guide

Completing the Azure Sensor Setup

When you enable any of these log collection jobs, USM Anywhere starts collecting data from them at the frequency you configure.

Note: If you look at ACTIVITY > EVENTS in USM Anywhere post-configuration, you can see all of the events associated with each log, including its Event ID and many other useful details.

You can also review related log collection jobs in the JOB SCHEDULER (either SETTINGS >

SCHEDULER or USERS > SCHEDULER).

To enable the out-of-box Azure log collection jobs, toggle the gray ENABLE icon so that it turns into a green check mark. USM Anywhere immediately starts collecting log data for the jobs you've enabled.

After you enable each job that you want, click Next.

The wizard displays the next page in the setup process, ACTIVE DIRECTORY.

ACTIVE DIRECTORY

The optional ACTIVE DIRECTORY setup page configures USM Anywhere to collect information from your Azure Active Directory (AD) account. To monitor Windows systems effectively,

USM Anywhere needs access to AD (Active Directory) server to collect inventory information.

AlienVault recommends that you create a dedicated AD account with membership in the Domain

Important: Before this feature is fully functional, you must allow access to the USM Anywhere

Sensor in the Active Directory server. For more information see,

Granting Access to Active

Directory for USM Anywhere

USM Anywhere™ Deployment Guide 115

Completing the Azure Sensor Setup

To complete the AD access configuration

1. Provide the AD credentials for USM Anywhere: l

Active Directory IP Address — Enter the IP address for the AD instance.

Username — Enter your username as administrator of the account.

Password — Enter your administrator's password.

Domain — Enter the domain for the AD instance.

116

2. Click Scan Active Directory.

After a successful launch of the scan, a confirmation dialog appears.

USM Anywhere™ Deployment Guide

Completing the Azure Sensor Setup

3. Click Accept.

The scan continues in the background.

Upon completion, another dialog appears and provides information about the number of assets

USM Anywhere discovered. It also prompts you to decide if you want to scan for hosts and services running in your environment.

Click CANCEL to opt out of this scan.

4. (Optional) If you want to scan for other hosts and services, click OK.

5. Click Next after the scan ends.

The wizard displays the next page in the setup process, LOG MANAGEMENT.

LOG MANAGEMENT

On the LOG MANAGEMENT page, you see the IP addresses of the assets you added during the asset discovery configuration. You also see the port number. (The port is the same for all

USM Anywhere Sensors.)

USM Anywhere collects third-party device data through syslog on port 514 by default. To configure any third-party devices to send data to USM Anywhere, you must give them the IP address of your

USM Anywhere Sensor and the port number.

USM Anywhere™ Deployment Guide 117

Completing the Azure Sensor Setup

118

Make sure that you've granted the necessary permissions for your operating system to allow

USM Anywhere to access its logs. You can also integrate a wide variety of plugins to send log data over syslog to the USM Anywhere Sensor.

To find out how to configure your operating system and supported third-party devices to forward syslog log data, see the following related topics: l

Log collection from a Linux System —

Log collection from a Windows System —

Log collection from other devices using a plugin —

Creating an Application and Obtaining Azure Credentials .

Note: Because the log scan can take some time, you may not immediately see all the automatically discovered log sources right after deploying the first sensor.

When you've finished the log collection setup and integrated any needed plugins, verify that the data transfer is occurring.

Click Next when this step is complete.

USM Anywhere™ Deployment Guide

Completing the Azure Sensor Setup

THREAT INTELLIGENCE

On the Threat Intelligence page, you can connect the deployed sensor to your AlienVault®

When you configure the OTX connection, the USM Anywhere Sensor receives raw pulse data from

OTX. After the deployed sensor starts to receive this data, USM Anywhere correlates that data and generates related OTX pulse and IP Reputation-related security events and alarms when it detects

IOCs interacting with assets in your environment. These events are displayed in the Open Threat

Exchange dashboard, which is available from the DASHBOARDS menu.

1. Log into OTX and open the API page ( https://otx.alienvault.com/api/ ).

2. In the DirectConnect API Usage panel, click the Copy ( ) icon to copy your unique

OTX connection key.

3. Return to the Threat Intelligence page of the USM Anywhere Sensor setup wizard and paste the value in the OTX Key text box.

USM Anywhere™ Deployment Guide 119

Completing the Azure Sensor Setup

120

4. Click Validate OTX Key.

With a successful validation of the key, the status at the top of the page changes to Valid

OTX key.

Click Next when this task is complete.

USM Anywhere™ Deployment Guide

SETUP COMPLETE

The Congratulations! page summarizes the status of your configuration.

Creating a New Azure Collection Job

Click Start Using USM Anywhere, which takes you to the Overview dashboard.

Next...

Now's a great time to run a vulnerability scan. You can learn how to run a vulnerability scan by going to Vulnerability Assessment in the USM Anywhere User Guide .

Creating a New Azure Collection Job

Use this procedure to either schedule an Azure REST Monitor (formerly known as Azure Insights)

Log job or to find all Azure Virtual Machines.

You do not need to do anything to enable Azure REST Monitor Logs in the Azure Portal for

USM Anywhere to be able to find them. USM Anywhere automatically discovers Azure logs and displays them in the Scheduler (System Configuration > Scheduler).

USM Anywhere™ Deployment Guide 121

Creating a New Azure Collection Job

Note: What an Insight Log scans depends on whether you granted contributor permissions to one of your resources or to your entire Azure subscription for the USM Anywhere application.

Give access to individual resource groups or the whole subscription. For details, see

To schedule a job to process Azure REST Monitor events (or find Azure virtual machines)

1. From System Configuration > Scheduler, locate the USM Anywhere Azure Sensor you want to run the log for and, within the far-right column, select Enable.

2. In the Schedule New Job dialog box, complete the fields as shown below: a. Name — Give the job a name.

b. Description — Describe the job in such a way that others easily understand what it does.

c. Select App — Select the Azure sensor to scan.

d. App Action — From the list, select the appropriate action to take, for example, Process

Azure Insight Logs.

e. Schedule — Select whether you want the job to occur within increments of minutes, hours, daily, weekly, monthly, or yearly. Then select the number, for example, every two hours or at a particular time of day, daily. (Time is UTC.)

122 USM Anywhere™ Deployment Guide

f. Click Save.

Creating a New Azure Collection Job

USM Anywhere™ Deployment Guide 123

Plugin Management

A plugin is a software component that provides logic specific to extracting data from a log produced by external applications and devices. Plugins then enrich this extracted information with securityspecific metadata. This metadata produces an event managed by USM Anywhere.

Within the USM Anywhere environment, a plugin has a specific scope of functionality: l

Performs a singular function to translate raw log data into normalized events for analysis by USM

Anywhere l

Does not collect log data or perform threat analysis l

Serves only as the translation mechanism for the data after it is collected

Note: Plugins are different from AlienApps™. Plugins have a singular function to translate raw log data into normalized events for analysis by USM Anywhere, but AlienApps do much more, including collecting and enriching log data, performing threat analysis, and providing workflow that coordinates response actions with the infrastructure and third-party applications to provide security orchestration.

This chapter includes the following topics:

USM Anywhere Plugin Integration and Enablement

Requesting a New Plugin or an Update to an Existing Plugin

USM Anywhere™ Deployment Guide 124

USM Anywhere Plugin Integration and Enablement

When plugins are configured to send log data to a remote syslog server (in this case, the

USM Anywhere sensor), USM Anywhere receives and analyzes it and records these data as events.

There are multiple areas where plugin integration takes place: l

Configuration on the plugin

side to send logs to the USM Anywhere sensor l

Enablement of the AlienVault Syslog Server app (in the SENSOR APPS section of the

DEPLOYMENT page) l

Automatic or manual enablement of the plugin on the USM Anywhere side

Autodiscovered Plugins

In USM Anywhere, many plugins are enabled automatically because of hints — unique information within a syslog message that identifies the data source sending the logs. These hints allow the syslog message to be read and the plugin type to be identified when the hints match the criteria set for each plugin type. Therefore, if a plugin accepts hints, USM Anywhere automatically identifies and enables it.

These automatically-enabled plugins are designated in the USM Anywhere web UI with

Autodiscover = YES.

Plugins Requiring Manual Enablement

Not all plugins accept hints, because some syslog messages contain only generic data. For hints to work, syslog messages must contain unique information. For this reason, USM Anywhere can neither automatically identify those plugins nor ready their syslog data. These plugins require manual enablement in the USM Anywhere web UI by associating the asset with the plugin or by associating the plugin with an asset.

These plugins are designated with Autodiscover = NO in the USM Anywhere web UI.

For detailed instructions about how to associate these plugins with an asset or asset group, see

USM Anywhere Plugin Integration and Enablement

125 USM Anywhere™ Deployment Guide

USM Anywhere Plugin Integration and Enablement

The "Fuzzy" Plugin

Occasionally, a log line does not match either a manually enabled or an auto-discovered plugin. In those cases, USM Anywhere parses it using the so-called fuzzy plugin. The fuzzy plugin tries to parse the log line using Regular Expressions and advanced text searches, including the following keywords: l get l device l to l src l srcip l source l client l loc_ip l rem_ip l from l dst l dstip l destination l

Remote-Address l netsession l session l zone l interface l unique_id l log_id l device_id l id l message l msg l proto l reason l tag l action

USM Anywhere™ Deployment Guide 126

USM Anywhere Plugin Integration and Enablement l sport l src_port l srcport l spt l loc_port l rem_port l dpt l dport l file l virus l user l

Username l to l from l name l initf l outif l srcmac l dstmac

After it scans for key phrases, it starts looking for patterns within the log. It typically looks for these patterns: l

<zone>sep<IP>sep<port> l

<IP>sep<port>sep<zone> l

Where separators can be one of the following:

: = , ; [ ] / \n

If USM Anywhere uses this best-effort plugin to parse a log line, it adds a

Was Fuzzied = True field to the event within the Events (ACTIVITY > EVENTS) page.

127 USM Anywhere™ Deployment Guide

Enabling Plugins Manually

You must manually enable a plugin that does not use hints to identify its data source (see

for more information). You can enable a plugin and associate it with an asset from two locations in the USM Anywhere web UI.

Enabling a Plugin from the Deployment Page

To enable a plugin from the Deployment page

1. From the USM Anywhere web UI, choose SETTINGS > DEPLOYMENT to open the

Deployment page.

2. On the left side of the page, below the Sensor Apps, click Manage Plugins.

3. Locate the plugin you want to associate with an asset and click the wrench icon in the plugin row.

USM Anywhere™ Deployment Guide 128

Enabling Plugins Manually

4. In the dialog, select the asset with which to associate the plugin.

Enter part of the asset name in the SET A NEW ASSET field and select the asset from the displayed list.

129

The system displays a confirmation of the add function:

Plugin added successfully

5. (Optional) Repeat the previous step to add another asset.

6. Close the dialog.

In the Plugin page, you can see that the plugin now has one or more associated assets.

USM Anywhere™ Deployment Guide

Enabling Plugins Manually

Enabling a Plugin from the Assets View

To enable a plugin from the Assets view

1. From the USM Anywhere dashboard, select ENVIRONMENT > ASSETS.

2. In the Assets list, click the name of the asset that you want to associate with a plugin.

This displays the Asset Details.

3. Click Full Asset Details to access the plugins information.

USM Anywhere™ Deployment Guide 130

Enabling Plugins Manually

4. At the bottom of the page, select the Plugins tab and click Add Plugin.

5. In the dialog, select the plugin with which to associate the asset.

Enter part of the plugin name in the SET A NEW PLUGIN field and select the plugin from the displayed list.

131

The system displays a confirmation of the add function:

Plugin added successfully.

6. (Optional) Repeat the previous step to add another plugin for the asset.

7. Close the dialog.

In the Asset Details you can now see that the asset has an associated plugin.

USM Anywhere™ Deployment Guide

Requesting a New Plugin or an Update to an Existing Plugin

For more information about managing discovered assets in USM Anywhere, see Asset

Management in the USM Anywhere User Guide.

Requesting a New Plugin or an Update to an Existing Plugin

AlienVault builds or updates plugins at the request of customers for products and devices available to the general public. To take advantage of this, customers must have an active AlienVault Support and Maintenance contract.

This policy does not apply to plugins for custom software or devices.

For information on the plugins we deliver out of the box with USM Anywhere, see this list of plugins .

Before Submitting Your Request

The more information we receive from you, the faster we can build the plugin and the more accurate it will be.

A complete plugin request includes: l

Product’s vendor, model, and version.

A description of the formatting of the product's logs. For more universal plugin application, choosing a standard event format such as the Common Event Format (CEF) is preferable, if it is available and suitable to your needs.

You may also want to consider using the product's default log settings in defining which fields to log. However, if a product has a particular logging configuration that you want the plugin to support, you should include that in your request.

A description of how you use the product, including which events and which data inside those events provide the most relevance to your business.

Specific log samples or database dumps of relevant device events. For best results, exclude any extraneous noise from the log samples, while still retaining all the data needed to differentiate the various events you want to capture with a plugin.

If you need information other than the date, source, destination, username, and protocol extracted from the logs, specify this in your request, and provide an example. This helps us test the plugin to make sure it can successfully extract that data.

USM Anywhere™ Deployment Guide 132

Requesting a New Plugin or an Update to an Existing Plugin l

Use case for the new plugin and the business value of the application or device to your organization. This information helps us assign a priority to your request.

After you have collected the information, click here to submit your request.

133 USM Anywhere™ Deployment Guide

Supported Plugins

USM Anywhere includes plugins for many commonly-encountered data sources. If you do not see a plugin that provides the needed integration with a software or hardware asset in your network, you can

submit a request for a new or updated plugin .

AlienVault provides the following plugins for USM Anywhere: l

Barracuda Next Gen Firewall Traffic

Barracuda Next Gen Firewall

Barracuda Spam Firewall

Barracuda Web Application Firewall (WAF)

Barracuda Web Filter

Brocade Router or Switch

Carbon Black Cb Protection

Carbon Black Cb Response

CheckPoint FW1

CheckPoint FW1 Generic Firewall

CheckPoint FW1 Loggrabber

USM Anywhere™ Deployment Guide 134

Supported Plugins l

Citrix NetScaler Application Firewall

CloudFront RTMP, Distribution W3C

Forcepoint Triton AP-Web

ForeScout Network Access Control

HP Storage Area Network (SAN) Switch

HP Switch

Huawei NGFW

IBM AIX Audit

IBM Tivoli Access Manager Web SEAL

Imperva SecureSphere Web Gateway

Imperva SecureSphere CEF

Incapsula Web Application Firewall

Juniper EX Series

Juniper SA SSL VPN

135 USM Anywhere™ Deployment Guide

Juniper SRX

Juniper SSG

Kaspersky Security Center

Malwarebytes Breach Remediation

Malwarebytes Endpoint Security

McAfee Database Security

McAfee Web Gateway

Microsoft Windows DNS Server

Microsoft IIS Server on AWS

Microsoft Windows IIS NXLog

Juniper Netscreen NSM

Palo Alto Networks PAN-OS

ProFTPD

RSA Authentication Manager

Ruckus Wireless ZoneDirector

Sophos Cyberoam

Sophos Enterprise Console

Trend Micro Control Manager

Trustwave Secure Web Gateway

Vectra Networks X-Series

USM Anywhere™ Deployment Guide

Supported Plugins

136

Supported Plugins l

zScaler NSS

137 USM Anywhere™ Deployment Guide

Supported Plugins

Apache Web Server

When you configure the Apache Web Server integration to send log data to USM Anywhere, you can use the Apache Web Server plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Resource link

Details

Apache

Web server syslog https://www.ibm.com/support/knowledgecenter/SS42VS_

7.2.3/com.ibm.dsm.doc/ t_DSM_guide_apache_cfg_syslog.html

Integrating Apache Web Server

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Apache to send log data to the USM Anywhere Sensor

1. Enter:

ErrorLog syslog:local1

This tells Apache to send the error log output to the syslog facility called local1.

You must also tell your syslog server to send this log output to the USM Anywhere Sensor and to write it to a log file.

2. To send log entries to the USM Anywhere Sensor: local1.* @<USM_ANYWHERE_SENSOR_IP_ADDRESS>

Plugin Enablement

The Apache plugin automatically processes all messages that have

"apache" as the syslog tag.

USM Anywhere™ Deployment Guide 138

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l bytes_out l event_description l event_name l request_method l request_url l response_code l source_address l time_zone l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.linode.com/docs/troubleshooting/troubleshooting-common-apache-issues

139 USM Anywhere™ Deployment Guide

Supported Plugins

Aruba Wireless

When you configure the Aruba Wireless integration to send log data to USM Anywhere, you can use the Aruba Wireless plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Aruba

Wireless security management syslog

None

Aruba Wireless Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

You can specify a syslog server to send syslog messages to external servers either by using the

Instant UI or CLI. The following procedures provide both approaches.

To configure Aruba Wireless Instant UI to send log data to USM Anywhere

1. Starting from the main Instant UI page, click System.

2. In the System page, select Show advanced options.

3. Click the Monitoring tab.

4. In the Syslog server field, type the IP Address of the USM Anywhere Sensor to which you want to send system logs.

5. Select the required values to configure syslog facility levels, then click OK.

To configure Aruba Wireless CLI to send log data to USM Anywhere

1. configure a syslog server:

(Instant Access Point)(config)# syslog-server <USM-Anywhere-Sensor-IP-

Address>

2. Configure syslog server facility levels:

(Instant Access Point)(config)# end

(Instant Access Point)# commit apply

3. Review syslog logging levels:

(Instant Access Point)# show syslog-level

Example:

USM Anywhere™ Deployment Guide 140

Supported Plugins

Logging Level

-------------

Facility Level

-------- ----ap-debug warn network warn security warn system warn user warn user-debug warn wireless error

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The plugin fields listed below are important attributes extracted from the syslog message. These fields are used in USM Anywhere reports and can be referenced when creating custom reports. In addition to reporting, the fields are also used by the USM Anywhere correlation rules.

l audit_reason l destination_address l destination_port l destination_hostname l destination_mac l event_action l event_description l event_name l policy l rep_device_address l rep_device_hostname l source_hostname l source_port l source_process l source_mac l wireless_ap

141 USM Anywhere™ Deployment Guide

Supported Plugins l wireless_bssid l wireless_channel l wireless_ssid

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://community.arubanetworks.com/aruba/attachments/aruba/84/106/1/Troubleshooting+Cheat

+Sheet-.pdf

USM Anywhere™ Deployment Guide 142

Supported Plugins

Avaya Media Gateway

When you configure the Avaya Media Gateway integration to send log data to USM Anywhere, you can use the Avaya Media Gateway plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Avaya

Media gateway syslog https://downloads.avaya.com/css/P8/documents/100059399

Integrating Avaya Media Gateway

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

Integration includes the following tasks.

Defining syslog Servers

You can define up to three syslog servers.

To configure Avaya Media Gateway to send log data to USM Anywhere

1. Define the syslog server: set logging server <USM Anywhere_IP_Address>

When you define the syslog server it is disabled by default, so you must enable it.

2. Enable the syslog server: set logging server enable <USM Anywhere_IP_Address>

3. (Optional) Define an output facility for the USM Anywhere Sensor, for example: set logging server facility auth <USM Anywhere IP Address>

Note: If you don't enter a facility name, facility 7 is used by default.

4. (Optional) Limit access to the USM Anywhere Sensor, for example: set logging server access-level read-only <USM Anywhere IP Address>

Use one of the following access level options:

143 USM Anywhere™ Deployment Guide

Supported Plugins l read-only l read-write l admin

Note: If you don't select an access level, read-write is used by default.

Only messages with the configured access level are sent to the syslog output.

5. (Optional) Define filters to limit the types of messages received.

Disabling a syslog Server

The syslog server in this case is the USM Anywhere Sensor you are associating with the plugin.

To disable a syslog server set logging server disable <USM Anywhere IP Address

Deleting a syslog Server

The syslog server in this case is the USM Anywhere Sensor you are associating with the plugin.

To delete a syslog server clear logging server <USM Anywhere IP Address>

Displaying syslog Server Status

The syslog server in this case is the USM Anywhere Sensor you are associating with the plugin.

To display the status of the syslog server show logging server condition <USM Anywhere IP Address>

Plugin Enablement

The Avaya Media Gateway plugin automatically processes all messages whose raw message tag matches

"mediagateway.g450"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l customfield_0 l customfield_1 l customheader_0

USM Anywhere™ Deployment Guide 144

Supported Plugins l customheader_1 l destination_address l event_category l event_description l event_name l event_severity l source_address l source_username

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://downloads.avaya.com/css/P8/documents/100015080

145 USM Anywhere™ Deployment Guide

Supported Plugins

Avaya VSP Switch

When you configure the Avaya VSP Switch integration to send log data to USM Anywhere, you can use the Avaya VSP Switch plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Avaya

Switch

Syslog https://downloads.avaya.com/css/P8/documents/100180474

Avaya VSP Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Avaya VSP to send log data to USM Anywhere

1. Enable the system log: syslog enable

2. Specify the IP header in syslog packets: syslog ip-header-type <circuitless-ip|default|management- virtual-ip>

3. Configure the maximum number of syslog hosts: syslog max-hosts <1-10>

4. Create the syslog host: syslog host <1-10>

5. Configure the IP address for the syslog host: syslog host <1-10> address WORD <0–46>

6. Enable the syslog host: syslog host <1-10> enable

Configure optional syslog host parameters by using the variables in the following variable definition tables.

7. View the configuration to ensure it is correct: show syslog [host <1–10>]

USM Anywhere™ Deployment Guide 146

Supported Plugins

Plugin Enablement

For plugin enablement information, see

Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l customfield_5 l customheader_0 l customheader_1 l customheader_2 l customheader_3 l customheader_4 l customheader_5 l event_action l event_description l event_name l event_severity l source_address l timestamp_occurred

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://downloads.avaya.com/css/P8/documents/100162409

147 USM Anywhere™ Deployment Guide

Supported Plugins

AWS Windows

When you configure the AWS Windows integration to send log data to USM Anywhere, you can use the AWS Windows plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Amazon

Management platform

Syslog

None

AWS Windows Integration

To integrate AWS CloudWatch Logs for Windows system logs, follow the AWS procedures for using the

EC2Config service. For more information about EC2 logs, see

AWS Log Discovery in

USM Anywhere .

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l authentication_mode l authentication_type l destination_address l destination_hostname l destination_port l event_category l event_subcategory l event_description l event_name l event_severity l file_hash l file_hash_algorithm

USM Anywhere™ Deployment Guide 148

Supported Plugins l file_name l file_create_time l file_old_create_time l rep_device_rule_id l source_address l source_hostname l source_ntdomain l source_port l source_process l source_process_commandline l source_process_id l source_process_parent l source_process_parent_commandline l source_process_parent_process_id l source_userid l source_username

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.iis.net/learn/troubleshoot

149 USM Anywhere™ Deployment Guide

Supported Plugins

Barracuda Next Gen Firewall Traffic

When you configure the Barracuda Next Gen (NG) Firewall Traffic integration to send log data to

USM Anywhere, you can use the Barracuda Next Gen (NG) Firewall Traffic plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Barracuda

Firewall syslog https://campus.barracuda.com/product/nextgenfirewallf/article/NGF70/

LogsConfigSyslogStreaming/

Integrating Barracuda Next Gen Firewall Traffic

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Barracuda NG Firewall Traffic to send log data to the USM Anywhere Sensor

1. Log into the NG Admin console as root and select Box.

2. In the Primary Navigation bar, select Configuration.

3. Go to Box > Infrastructure Services > Syslog Streaming.

4. Right-click on Syslog Streaming and select Lock.

5. On Syslog Streaming, under Basic Setup, select Yes for Enable Syslog Streaming.

If using SSL for log file streaming, you may require a certificate different from the key and certificate by which the box is routinely identified. If so: a. Select Switch to Advanced View in the left Configuration Mode menu.

b. Disable Use Box Certificate/Key.

c. Export the certificate and key.

This certificate must be imported on the destination server for SSL-based authentication.

6. In the top-right corner of the page, under the Task bar, click Send Changes.

7. Select Activation Pending.

8. Select Activate.

USM Anywhere™ Deployment Guide 150

Supported Plugins

Plugin Enablement

The Barracuda Next Gen Firewall Traffic plugin automatically processes all messages whose syslog tag matches one of the following values

"box_Firewall_Activity"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l audit_reason l bytes_in l bytes_out l content_category l destination_address l event_action l event_name l file_hash l matched_value l plugin_rule l request_content_type l request_url l source_address l source_username l timestamp_occured l timestamp_received

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.barracuda.com/support/knowledgebase

151 USM Anywhere™ Deployment Guide

Supported Plugins

Barracuda Next Gen Firewall

When you configure the Barracuda Next Gen (NG) Firewall integration to send log data to USM

Anywhere, you can use the Barracuda Next Gen (NG) Firewall plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Barracuda

Firewall syslog https://campus.barracuda.com/product/nextgenfirewallf/article/NGF70/

LogsConfigSyslogStreaming/

Integrating Barracuda Next Gen Firewall

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Barracuda Next Gen Firewall to stream log data to the USM Anywhere Sensor

1. Go to the LOGS > Log Streaming.

2. In the Stream target field, type the hostname or IP address of your USM Anywhere Sensor.

Note: Only one target can be defined.

3. In Protocol / Port, select UDP/ 514.

4. Select the log streams you want to enable.

5. Click Save Changes.

6. Verify that a connection exists between the device and the USM Anywhere Sensor: a. Go to BASIC > Recent Connections.

b. Filter the list of connections for the Protocol, Service, and Destination IP of your

USM Anywhere Sensor.

Plugin Enablement

The Barracuda NG Firewall X-Series plugin automatically processes all messages whose syslog tag matches the values

"box_Auth,box_Control, box_System, box_Config, box_SSH, box_

Event, box_Firewall" or "srv_S1".

USM Anywhere™ Deployment Guide 152

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l application_protocol l base_event_count l bytes_in l bytes_out l content_category l customfield_0 l customfield_1 l customheader_0 l customheader_1 l destination_address l destination_nat_address l destination_port l destination_service_name l device_inbound_interface l duration l event_category l event_description l event_name l event_severity l packets_received l packets_sent l rep_device_model l rep_device_outbound_interface l rep_device_rule_id l source_address l source_mac l source_nat_address l source_port

153 USM Anywhere™ Deployment Guide

l source_username l timestamp_occured l timestamp_received l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.barracuda.com/support/knowledgebase

Supported Plugins

USM Anywhere™ Deployment Guide 154

Supported Plugins

Barracuda Spam Firewall

When you configure the Barracuda Spam Firewall integration to send log data to USM Anywhere, you can use the Barracuda Spam Firewall plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Barracuda

Email security gateway syslog https://www.barracuda.com/

Integrating the Barracuda Spam Firewall

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Barracuda Spam Firewall to send log data to the USM Anywhere Sensor

1. Go to Advanced > Advanced Networking.

2. In the Syslog Configuration section, specify the IP address of the USM Anywhere Sensor in both blank spaces: l

Mail Syslog l

Web Interface Syslog

3. Click Save.

Plugin Enablement

The Barracuda Spam Firewall plugin automatically processes all messages whose syslog tag matches one of the following values:

"inbound/pass1, inbound/pass2, scan, outbound/smtp"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l source_address l email_sender l event_name l source_hostname

155 USM Anywhere™ Deployment Guide

l event_outcome l email_recipient l event_description l email_subject l timestamp_occured l timestamp_received

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.barracuda.com/support/knowledgebase

Supported Plugins

USM Anywhere™ Deployment Guide 156

Supported Plugins

Barracuda Web Application Firewall (WAF)

When you configure the Barracuda Web Application Firewall integration to send log data to USM

Anywhere, you can use the Barracuda Web Application Firewall plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Barracuda

Web application firewall syslog https://www.barracuda.com/

Barracuda WAF Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Barracuda WAF to send log data to the USM Anywhere Sensor

1. Go to the ADVANCED > Export Logs page.

2. In the Export Logs section, click Add Export Log Server.

3. In the Add Export Log Server window, specify values for the following: a. Name — Enter a name for the export log server.

b. Log Server Type — Select the server type to export the logs.

c. IP Address — Enter the IP address of the export log server.

d. Port — Enter the port associated with the IP address of the export log server.

e. Log Timestamp and Hostname — If you want to log the date and time of the event, and the

157 USM Anywhere™ Deployment Guide

Supported Plugins hostname configured on BASIC > IP Configuration > Domain Configuration, set to Yes .

4. Click Add.

USM Anywhere™ Deployment Guide 158

Supported Plugins

159

5. To configure facilities for different log types: a. Go to ADVANCED > Export Logs.

b. In Export Logs, select Export Log Settings.

c. In the Syslog Settings section of the Export Log Settings dialog box, select the appropriate facility (Local0 to Local7) from the list for each log type, and click Save.

Note: You can set the same facility for all log types. For example, you can set Local0 for System Logs, Web Firewall Logs, Access Logs, Audit Logs, and Network Firewall

Logs.

In the Export Log Settings dialog box, you can

USM Anywhere™ Deployment Guide

Supported Plugins o

Enable or disable the logs that needs to be exported to the configured export log server

(s) in Export Log Settings.

Set the severity level to export web firewall logs and system logs to the configured export log server(s) In Export Log Filters.

The Barracuda Web Application Firewall exports the logs based on the selected severity level. For example, if Web Firewall Log Severity is set to 2-Critical, then logs with 0-2 are sent to the external log server (in other words, 0-Emergency, 1-Alert, and 2-Critical).

USM Anywhere™ Deployment Guide 160

Supported Plugins

161

Plugin Enablement

The Barracuda Web Filter plugin automatically processes all messages whose syslog tag matches one of the following values:

"?<date>\\d{4}-\\d{2}-\\d{2}\\s+\\d{2}:\\s*\\d{2}:\\d{2}.\\d{3}\\s+(?:-

|\\+)\\:d{4})\\s+(?<device>\\S+)\\s+(TR|WF|AUDIT|SYS)".

USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l authentication_type l destination_address l destination_port l destination_username l event_action l event_description l event_name l event_severity l http_hostname l policy l rep_device_address l rep_device_hostname l rep_device_rule_id l request_cookies l request_http_version l request_method l request_referrer l request_url l request_user_agent l response_code l session l source_address l source_port l source_process_commandline l source_username l timestamp_occured l customfield_0 l customfield_1

USM Anywhere™ Deployment Guide 162

Supported Plugins l customfield_2 l customfield_3 l customfield_4 l customfield_5 l customheader_0 l customheader_1 l customheader_2 l customheader_3 l customheader_4 l customheader_5

Troubleshooting

For troubleshooting, refer to the vendor documentation: l https://www.barracuda.com/support/knowledgebase l https://campus.barracuda.com/product/webapplicationfirewall/article/WAF/ConfigSyslog/

163 USM Anywhere™ Deployment Guide

Supported Plugins

Barracuda Web Filter

When you configure the Barracuda Web Filter integration to send log data to USM Anywhere, you can use the Barracuda Web Filter plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Barracuda

Web filter syslog https://www.barracuda.com/

Barracuda Web Filter Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To send log data from Barracuda Web Filter to USM Anywhere

1. Go to the Advanced tab and SYSLOG.

2. Specify the IP Address of the USM Anywhere Sensor in both Web Traffic Syslog and Web

Interface Syslog.

Plugin Enablement

The Barracuda Web Filter plugin automatically processes all messages whose syslog tag matches one of the following values

"httpscan,http_scan,sniff"

USM Anywhere™ Deployment Guide 164

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.barracuda.com/support/knowledgebase

Blue Coat Web Proxy W3C

When you configure Blue Coat Web Proxy W3C to send log data to USM Anywhere, you can use the Blue Coat W3C plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Blue Coat

Web Proxy

Syslog

165 USM Anywhere™ Deployment Guide

Supported Plugins

Integrating Blue Coat Web Proxy W3C

Before you configure a Blue Coat Web Proxy W3C integration, you must have the IP Address of the

USM Anywhere Sensor.

To configure Blue Coat Web Proxy W3C to send log data to USM Anywhere

Blue Coat Web Proxy W3C must be configured to send log data to USM Anywhere using the Syslog protocol.

You can configure Blue Coat Web Proxy W3C so that events that are written to an Access Log, in addition to being sent to a Syslog server (such as USM Anywhere). That will also allow the Syslog server to display the log entries in real-time.

Note: You must specify the IP Address of USM Anywhere as the IP address of the Syslog server and set the port to 514.

The following steps detail Blue Coat Web Proxy W3C integration using Blue Coat software:

1. Define a Blue Coat access log file configured to your requirements.

2. Configure the Upload Client for this access log as type "Custom Client" and save the log file as

"a text file".

3. Optionally, to reduce the transmission time for log uploads, enter a value (as low as 5) in the

"Send partial buffer after" field.

4. Point the Custom client to the Syslog server, in this case, USM Anywhere. Also specify the appropriate TCP number. For AlienVault syslog collection, the port number is 514.

5. For the log's upload schedule, specify "upload continuously".

6. Load the Visual Policy Manager and in a Web Access Layer, set the Action to "Modify Access

Logging".

7. In the Access Logging object, enable logging to your new access log.

Note: Blue Coat Web Proxy W3C steps for performing Syslog integration with USM

Anywhere are based on the following Blue Coat knowledgebase article: http://bluecoat.force.com/knowledgebase/articles/Solution/HowtowriteAccessLogstoaSYSL

OGserver

Blue Coat, Inc. has since been acquired by the Symantec Corporation, so you may be redirected to the Symantec web site for information on Blue Coat software.

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 166

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l bytes_in l bytes_out l destination_address l destination_port l event_name l malware_variant l rep_device_address l request_content_type l request_method l request_url l request_user_agent l response_code l source_address l source_username l timestamp_occured l timestamp_received

Additional Resources and Troubleshooting

For troubleshooting, refer to the vendor documentation: https://assets.documentcloud.org/documents/815883/167-blue-coat-instruction-proxysg.pdf

http://bluecoat.force.com/knowledgebase/articles/Solution/HowtowriteAccessLogstoaSYSLOGser ver

167 USM Anywhere™ Deployment Guide

Supported Plugins

Brocade Router or Switch

When you configure the Brocade Router or Switch integration to send log data to USM Anywhere, you can use the Brocade Router or Switch plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Brocade

Router/Switch syslog http://www.brocade.com/content/html/en/command-reference-guide/nos-

602-commandref/GUID-E6AE512A-6F10-4555-8A66-C1A0906F70DB.html

Brocade Router or Switch Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

Use this command to configure a switch to forward all error log entries to one or more specified servers. You can configure up to four syslog servers.

To configure Brocade to send log data over syslog to USM Anywhere l

In global configuration mode, configure a router/switch to forward system messages to the

USM Anywhere Sensor : logging syslog-server <USM Anywhere Sensor-IP_address> [use-vrf <vrf-name>

[ secure ]

Where: use-vrf =

Specifies a specific VRF.

vrf-name =

A VRF instance (For details, see the Brocade Usage Guidelines.) secure =

Configures a secure default (port 514) or specified nondefault syslog server port. A secure port number with default values is not shown in the Brocade Network OS database.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

USM Anywhere™ Deployment Guide 168

Supported Plugins l application_protocol l customfield_0 l customfield_1 l customheader_0 l customheader_1 l destination_hostname l destination_vpn l device_inbound_interface l event_description l event_name l session l source_address l source_mac l source_username l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.brocade.com/content/html/en/troubleshooting-guide/fos-740troubleshooting/index.html

169 USM Anywhere™ Deployment Guide

Supported Plugins

Carbon Black Cb Protection

When you configure Carbon Black Cb Protection (formerly Bit9 Security Platform) integration to send log data to USM Anywhere, you can use the Cb Protection plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Carbon Black

Cb Protection syslog https://www.carbonblack.com/resources/resource-library/

Cb Protection Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Cb Protection to send log data to USM Anywhere Sensor

1. Log into the Cb Protection console with Administrator or Power User privileges.

2. From the primary navigation bar, select Administration > System Configuration.

3. Click Server Status and click Edit.

4. In the Syslog address field, enter the IP address of your USM Anywhere Sensor.

5. Select Syslog-enabled and click Update.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customheader_0 l event_category l event_description l event_name l event_subcategory

USM Anywhere™ Deployment Guide 170

Supported Plugins l file_hash l file_name l file_path l rep_device_rule_id l source_address l source_hostname l source_process l source_username l timestamp_occured l timestamp_received

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.carbonblack.com/products/services/customer-support/

171 USM Anywhere™ Deployment Guide

Supported Plugins

Carbon Black Cb Response

When you configure Carbon Black Cb Response (formerly Carbon Black Endpoint Security) integration to send log data to USM Anywhere, you can use the Cb Response plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Carbon Black

Cb Response

Syslog https://www.carbonblack.com/resources/resource-library/

Cb Response Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To send log data from Cb Response to USM Anywhere

1. Install the RPM Package Manager for cb-event-forwarder

: yum install cb-event-forwarder

2. Modify the

/etc/cb/integrations/event-forwarder/cb-event-forwarder.conf

file to include the following: udpout=<USM_Anywhere_Sensor_IP_address>:514.

3. If you are not installing on the Cb Response server: l

Locate

/etc/cb/integrations/event-forwarder/cb-event-forwarder.conf

, and copy the

RabbitMQ user name and password into the rabbit_mq_username and rabbit_ mq_password variables, respectively.

In the cb_server_hostname variable, enter the host name or IP address of the Cb

Response server.

4. Ensure that the configuration is valid by running the cb-event-forwarder in check mode:

/usr/share/cb/integrations/event-forwarder/cb-event-forwarder -check l

If valid, the message

Initialized output displays.

If there are errors, they output to the screen.

By default, Cb Response publishes all feed and watchlist events over the bus.

USM Anywhere™ Deployment Guide 172

Supported Plugins

5. Choose the type of event that you want to capture by enabling them within the

/etc/cb/cb.conf

file: l

Raw sensor events — Edit the

DatastoreBroadcastEventTypes option to enable broadcast of the raw sensor events that you want to export.

Binary observed events — Set the

EnableSolrBinaryInfoNotifications option to True.

6. To enable your changes to the file, restart the Cb Response server: service cb-enterprise restart

7. Start the cb-event-forwarder service: initctl start cb-event-forwarder

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l audit_reason l customfield_0 l customfield_1 l customheader_0 l customheader_1 l destination_address l destination_address_6 l destination_port l device_direction l device_external_id l event_category l event_description l event_description_url l event_name

173 USM Anywhere™ Deployment Guide

l event_severity l file_hash l file_hash_algorithm l file_path l rep_device_rule_id l reputation_score l security_group_name l source_address l source_address_6 l source_nat_address l source_process l source_hostname l time_end l timestamp_occured l time_start l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.carbonblack.com/resources/resource-library/

Supported Plugins

USM Anywhere™ Deployment Guide 174

Supported Plugins

CheckPoint FW1

When you configure Check Point Firewall-1 to send log data to USM Anywhere, you can use the

CheckPoint FW1 plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Check Point

Firewall

Syslog

Integrating Check Point Firewall-1

Before you configure the Check Point Firewall-1 integration, you must have the IP Address of the

USM Anywhere Sensor and the firewall must have the Add-On Package R77.30 installed.

Note: This procedure does not support the Provider-1 / Multi-Domain Server.

To configure Check Point Firewall-1 to send data to USM Anywhere

1. On the Check Point appliance, back up the current

/etc/syslog.conf

script: cp /etc/syslog.conf /etc/syslog.conf_ORIGINAL

2. Edit the current

/etc/syslog.conf

script by adding the following line: local4.info @<IP address of the USM Anywhere Sensor>

Note: Press TAB after

local4.info

3. Save your configuration edits and close the file.

4. Back up the

/etc/rc.d/init.d/cpboot script, and edit the current version of

/etc/rc.d/init.d/cpboot by adding the following line at the bottom of the script: fw log -f -t -n -l 2> /dev/null | awk 'NF' | logger –p local4.info -t CP_

FireWall &

Where:

= run command in the background. If & is not included, the operating system stops before loading the syslogd service. No login prompt then appears at the console.

For help on available flags, enter: fw log --help

5. Save the configuration edits and close the file.

175 USM Anywhere™ Deployment Guide

Supported Plugins

6. Restart the machine.

Important: Restarting the Check Point services with the cpstop;cpstart commands does not suffice. Only a restart achieves the desired result.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l customfield_0 l destination_address l destination_hostname l destination_ntdomain l destination_port l event_name l event_outcome l event_severity l file_path l rep_device_inbound_interface l rep_device_mac l session l source_address l source_hostname l source_port l source_process l source_process_commandline l source_userid l source_username l timestamp_occured l timestamp_received l transport_protocol

USM Anywhere™ Deployment Guide 176

Supported Plugins

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.networksecurityplus.net/2015/02/check-point-basic-troubleshooting-commandreference.html

177 USM Anywhere™ Deployment Guide

Supported Plugins

CheckPoint FW1 Generic Firewall

When you configure CheckPoint FW1 Generic Firewall integration to send log data to USM

Anywhere, you can use the CheckPoint FW1 Generic Firewall plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

CheckPoint

Firewall syslog https://www.checkpoint.com/smb/help/utm1/8.0/441.htm

Integrating CheckPoint FW1 Generic Firewall

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure CheckPoint FW1 Generic to send log data through syslog to USM Anywhere

1. In the Main menu, click Setup, then the Logging tab.

2. On the Logging page, complete the form by filling the following fields.

Syslog Server — IP address of USM Anywhere Sensor

Clear — Clears the Syslog Server field

Syslog Port — 514

Default — Resets the Syslog Port field to the default (514 UDP)

3. Click Apply.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l authentication_mode l customfield_1 l customfield_2

USM Anywhere™ Deployment Guide 178

Supported Plugins l customfield_3 l customfield_4 l customfield_5 l customfield_6 l customfield_7 l customfield_8 l customfield_9 l customfield_11 l destination_address l destination_port l destination_service_name l destination_vpn l event_description l event_name l event_severity l new_ip l old_ip l policy l rep_device_address l rep_device_hostname l rep_device_model l rep_device_rule_id l source_address l source_port l source_username l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation:

CheckPoint Troubleshooting and Debugging Tools for Faster Resolution

179 USM Anywhere™ Deployment Guide

Supported Plugins

CheckPoint FW1 Loggrabber

When you configure CheckPoint FW1 Loggrabber integration to send log data to USM Anywhere, you can use the CheckPoint FW1 Loggrabber plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

CheckPoint

Firewall

Syslog https://www.checkpoint.com

CheckPoint FW1 Loggrabber Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

Use this procedure on a UNIX machine only to configure CheckPoint FW1 to send log data to

USM Anywhere.

The firewall has two configuration files: l fw1-loggrabber.conf

— Contains information on how the actual log extraction should behave l lea.conf

— Contains details about the firewall to be connected

To configure CheckPoint FW1 to send log data to USM Anywhere

1. Go to

/usr/local/fwl-loggrabber

2. Display the fw1-loggrabber.conf

configuration file: cat../etc/fwl-loggrabber.conf

3. Set

LOGGING_CONFIGURATION =

syslog

4. Set

SYSLOG_FACILITY =

LOCAL0

5. Save the changes to the file.

USM Anywhere™ Deployment Guide 180

Supported Plugins

Example

181

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports. In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customfield_1 l customfield_2 l customfield_4

USM Anywhere™ Deployment Guide

l customfield_5 l destination_address l destination_port l destination_translated_address l destination_translated_port l device_direction l event_description l event_name l policy l rep_device_address l rep_device_inbound_interface l rep_device_model l rep_device_outbound_interface l source_address l source_port l source_translated_address l source_translated_port l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, see the vendor documentation.

USM Anywhere™ Deployment Guide

Supported Plugins

182

Supported Plugins

Cisco ACE

When you configure Cisco ACE integration to send log data to USM Anywhere, you can use the

Cisco ACE plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

Cisco

Application Control Engine syslog http://www.cisco.com/c/en/us/td/docs/interfaces_modules/services_modules/ ace/vA4_2_0/configuration/system/message/guide/sysmsggd/config.html

Cisco ACE Integration

Before you configure the integration, you must have the following: l

IP address of the USM Anywhere Sensor l

Administrator privilege for Cisco ACE l

Connection access to USM Anywhere through syslog from Cisco ASA.

To configure Cisco ACE to send log data to USM Anywhere

1. Enable system message logging: host1/Admin# changeto C1 host1/C1#

Note: If you operate in multiple contexts, take care to observe the displayed prompt to verify that you are currently in the desired context.

2. Enter configuration mode: host1/Admin# config

Enter configuration commands, one per line. End with CNTL/Z host1/Admin(config)#

3. Enable logging to one or more output locations: host1/Admin(config)# logging enable

4. Send syslog messages to USM Anywhere: logging host <USM_Anywhere_IP_address> udp514 [format emblem][default-udp]

183 USM Anywhere™ Deployment Guide

Supported Plugins

Example host1/Admin(config)# logging host 192.168.10.1 udp514 format emblem default-udp

Note: Format Emblem enables EMBLEM format logging for syslog.

5. Save your changes to the Startup configuration: host1/Admin(config)# do copy running-config startup-config

6. Exit configuration mode: host1/Admin(config)# exit

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l bytes_out l customfield_0 l destination_address l destination_port l duration l event_action l event_category l event_description l event_name l event_severity l event_subcategory l gateway l policy l source_address l source_port l transport_protocol

USM Anywhere™ Deployment Guide 184

Supported Plugins

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://docwiki.cisco.com/wiki/Cisco_Application_Control_Engine_(ACE)_Troubleshooting_Guide

185 USM Anywhere™ Deployment Guide

Supported Plugins

Cisco ACS

When you configure Cisco ACS integration to send log data to USM Anywhere, you can use the

Cisco ACS plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

Cisco

Access control server syslog http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_ control_system/5-8/user/guide/acsuserguide.html

Cisco ACS Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Cisco ACS to send log data to USM Anywhere

1. Click System Administration > Log Configuration > Remote Log Targets.

2. Click Create.

3. Define the name of external syslog server and its IP address. You can also add the port number, which is 514 by default.

4. Click Submit.

USM Anywhere™ Deployment Guide 186

Supported Plugins

5. Verify that the external syslog server was created and that it appears in the list.

6. Click System Administration > Logging Categories > Global.

7. Select the logging category you want to use to send the logs to the external syslog server.

8. Click Edit.

9. Select the Remote Syslog Target tab.

10. Move the configured syslog server to the selected target.

187

11. Click Submit.

USM Anywhere™ Deployment Guide

Supported Plugins

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l authentication_mode l authentication_type l customfield_0 l customfield_1 l customfield_10 l customfield_11 l customfield_12 l customfield_13 l customfield_2 l customfield_3 l customfield_4 l customfield_5 l customfield_6 l customfield_7 l customfield_8 l customfield_9 l customheader_0 l customheader_1 l customheader_10 l customheader_11 l customheader_12 l customheader_13 l customheader_2 l customheader_3 l customheader_4 l customheader_5 l customheader_6

USM Anywhere™ Deployment Guide 188

Supported Plugins l customheader_7 l customheader_8 l customheader_9 l destination_address l destination_port l destination_service_name l event_action l event_description l event_name l event_outcome l event_severity l rep_device_address l rep_device_hostname l rep_device_version l session l source_address l source_port l source_username l timestamp_occured l transport_protocol

Network Device Groups l

NAS-port-id l

Service-Type l

Calling-Station-ID l

Response l

SelectedAccessType l

Port l

Called-station-id l

AdministratorClientIP l

AdminIPAddress l

AdminName

189 USM Anywhere™ Deployment Guide

ConfigVersionId l

RequestLatency l

Type

Troubleshooting

For troubleshooting, see the vendor documentation.

Supported Plugins

USM Anywhere™ Deployment Guide 190

Supported Plugins

Cisco ASA

When you configure Cisco ASA to send log data to USM Anywhere, you can use the Cisco ASA plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Cisco

UTM

Syslog

Integrating Cisco ASA

Before you configure the Cisco ASA integration, you must have the IP Address of the USM

Anywhere Sensor and the Cisco Adaptive Security Device Manager (ASDM).

To configure Cisco ASA to send log data to USM Anywhere

1. Connect to the ASA box, using ASDM.

2. Go to Configuration > Device Management > Logging > Syslog Servers and click Add to add a syslog server.

Note: Make sure you have connectivity between the Cisco ASA and the USM Anywhere

Sensor.

3. In the Add Syslog Server dialog, specify the following: a. Interface associated with the server b. USM Anywhere Sensor IP address c. Protocol (TCP or UDP) d. Port number, depending on your network setup e. Click OK

191 USM Anywhere™ Deployment Guide

The new syslog server appears under Configuration > Device Management > Logging >

Syslog Servers.

Supported Plugins

4. To configure the server, select it and click Edit: a. Specify the number of messages allowed to be queued.

b. If the transport protocol between the ASA and the syslog server is TCP, select Allow user traffic to pass when TCP Syslog server is down . Otherwise, ASA denies the new user sessions.

Important: By default, new network access sessions are denied by the Cisco ASA when a syslog server is down for any reason.

c. Click Apply.

Setting the Syslog Logging Level for Cisco devices

All Cisco devices that support Syslog collection and output of system messages typically let you set a logging level which determines the type and severity of the messages that are sent to a Syslog host such as USM ApplianceUSM Anywherefor processing and analysis. The following table describes the broad classification of each of these logging levels.

Logging Level

Keyword/Severity Level

emergency

Description

System is unusable. Typically devices do not generate

Sylog messages with a severity/logging level of 0.

USM Anywhere™ Deployment Guide 192

Supported Plugins

7 alert critical error warning notification informational debugging

Immediate action is needed. These messages indicate that action has been taken by the security appliance to resolve a problem or that action needs to be taken by the administrator because of an interface failure, unit standby failure, or bad cables. An administrator should always follow up on an alert message.

Critical condition requiring immediate attention. These messages indicate that traffic has been blocked or dropped, that spoofed traffic has been detected, or that flags are invalid in traffic. An administrator should usually follow up on critical messages.

Error condition or event. These error messages are specific to security appliance resources such as xlate failures and translation slot failures. An administrator should always follow up on error messages.

Warning condition or event. These messages are generally warnings about connection problems. An administrator might have to follow up on these warning messages.

Normal but significant conditions or events. These messages are a mix of notifications of what a security appliance logged-in user is doing on the machine and some messages about Java and ActiveX blocking. An administrator should look at these messages to ensure that unauthorized changes are not being made to the security appliance.

Informational messages only. These messages describe connections being built and torn down through the security appliance. In most cases, these messages don't need to be audited by an administrator unless users report that they are having problems with specific connections or services.

Debugging messages only. These messages are mostly related to IPSec. An administrator uses these messages when bringing up an IPSec tunnel for the first time. For the other debug messages, refer to your device's technical documentation on the Cisco website.

When you set a logging level, all messages with the same classification number (and lower) are output to the Syslog server that collect these messages. In addition, with many of these devices, you can also limit the rate or amount of syslog message volume that is output.

193 USM Anywhere™ Deployment Guide

Supported Plugins

Note: Refer to the vendor documentation provided for your specific device, on the logging commands that are available, and how to use them to control Syslog message output.

By default, most Cisco devices are configured at notification (5) or informational (6) levels for Syslog messages directed to USM Anywhere. (Logging level 7 is not recommended for Syslog message output.) However, you may want to monitor the volume of messages that you are receiving from any particular device, particularly if the logging level is set at informational (6), because storage space can become an issue. You can also determine whether collecting any informational messages contributes significantly to your security monitoring efforts, or is just creating a lot of "noise".

Plugin Enablement

The Cisco ASA plugin will automatically process all messages whose syslog tag matches the following regular expression:

"(#|%)(AAA|ACL)"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l app_name l audit_reason l customfield_0 l customfield_1 l destination_address l destination_nat_address l destination_nat_port l destination_port l email_sender l event_category l event_name l event_severity l event_subcategory l rep_device_inbound_interface l rep_device_outbound_interface l rep_device_rule_id l request_url l security_group_name l source_address

USM Anywhere™ Deployment Guide 194

Supported Plugins l source_mac l source_nat_address l source_nat_port l source_port l source_process_commandline l source_username l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generationfirewalls/113053-asa82-syslog-config-00.html#trshoo

Cisco ASR

When you configure Cisco ASR Router integration to send log data to USM Anywhere, you can use the Cisco ASR plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Details

Cisco

Device type Router

Connection type syslog

Resource link http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-16/esm-xe-16book/esm-syslog.html

Integrating the Cisco ASR Router

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure the Cisco ASR Router to send log data over syslog to USM Anywhere

1. Enable privileged EXEC mode.

Device> enable

2. Provide your login credentials, if prompted.

3. Enter global configuration mode.

195 USM Anywhere™ Deployment Guide

Supported Plugins

Device# configure terminal

4. Specify one or more syslog filter modules you want applied to generated system logging messages.

Device(config)# logging filter <filter-url> [position] [args <filterarguments>]

Note: Repeat this command for every syslog filter you intend to use.

Where: l

The filter-url variable is the Cisco IOS File System location of the syslog filter module

(script). The location can be in local memory or a remote server, using tftp:

, ftp:

, or rcp:

The optional position argument specifies the order in which the syslog filter modules should run. If this argument is omitted, the specified module runs last in the chain of modules.

Filters can be reordered quickly by again entering the logging filter command and specifying a different position.

The optional args filter-arguments syntax can be added to pass one or multiple arguments to the specified filter.

The number and type of arguments should be defined in the syslog filter module. For example, if the syslog filter module is designed to accept a specific e-mail address as an argument, you could pass the e-mail address using the args [email protected]

syntax.

Note: To delimit multiple arguments, use spaces.

To remove a module from the list of modules to be executed, use the no form of this command.

5. Specify the USM Anywhere Sensor for ESM-filtered syslog output by entering one of the following:

Device(config)# logging host {<ip-address> | <hostname>} filtered [stream

<stream-id>].

Where: l

The stream tag allows you to specify a remote host destination, based on the type of message.

The stream <stream-id> syntax allows you to configure the ESM to send only messages that have a specified stream value to a certain host. The stream value is applied to messages by the configured syslog filter modules. For example, all Severity 5 messages could have a stream tag of 20.

6. Repeat the previous step for each desired logging destination.

USM Anywhere™ Deployment Guide 196

Supported Plugins

By repeating the step, you can configure messages at different severity levels to be sent to

USM Anywhere. For example, you may want to display only important messages to the screen at your network operations center (NOC).

You can also this to configure sending data to multiple targets for multiple system logging streams.

7. (Optional) Specify the source interface for syslog messages sent to USM Anywhere.

Device (config)# logging source-interface <interface_type-number>

Normally, a syslog message sent to remote hosts uses any interface available at the time of message generation. This command forces the device to send syslog messages to remote hosts only from the specified interface.

8. End the configuration session and return to privileged EXEC mode.

Device(config)# end

Plugin Enablement

For plugin enablement information, see

Creating Health Monitor Alerts

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_port l event_description l event_name l event_severity l source_address l source_port l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation:

Cisco IOS XR Troubleshooting Guide for the Cisco ASR 9000 Aggregation Services Router (pdf)

197 USM Anywhere™ Deployment Guide

Supported Plugins

Cisco FireSIGHT

When you configure Cisco FireSIGHT integration to send log data to USM Anywhere, you can use the FireSIGHT plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Cisco

Centralized Policy, Event, and Device Management syslog http://www.cisco.com/c/en/us/products/collateral/security/firesightmanagement-center/datasheet-c78-732251.html

Cisco FireSIGHT Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

As part of configuring Cisco FireSIGHT to send log data over syslog to USM Anywhere, you must configure it to send the following alerts: l

Intrusion alerts l

Health alerts l

Impact flag, discover event, and malware alerts

Sending Intrusion Alerts

To generate an alert, use this intrusion policy in the Access Control rule.

If no Access Control rule exists, configure this intrusion policy to be the default action of the Access

Control policy, then reapply the Access Control policy. Should an intrusion event occur, it triggers an alert to be sent to the syslog server configured on the intrusion policy.

To configure Cisco FireSIGHT to send log data to USM Anywhere

1. After logging into the web interface of your FireSIGHT Management Center, go to Policies >

Intrusion > Intrusion Policy.

2. Click Edit next to the policy you want to apply.

3. In the left-hand navigation pane, select Advanced Settings.

4. Locate Syslog Alerting in the list: a. Set it to Enabled.

b. Click Edit.

USM Anywhere™ Deployment Guide 198

Supported Plugins

5. In the Syslog Alerting dialog, enter the IP address of the USM Anywhere Sensor in the Logging

Hosts field.

6. Expand the Facility and Severity lists, and select appropriate values.

Alternatively, you may accept the default values unless the syslog server was configured to accept alerts for a specific facility at a specific severity level.

7. At the top of the left navigation pane, select Policy Information.

8. Click Commit Changes.

9. Reapply your intrusion policy.

Sending Health Alerts

Sending health alerts consists of two parts: l

Creating syslog Alerts

Creating syslog Alerts

This procedure configures syslog alerts.

To configure syslog alerts

1. From the web interface of FireSIGHT Management Center, go to Policies > Actions > Alerts.

2. On the right side of the page, click Create Alert to expand the list of alerts and select Create Syslog Alert.

3. In the Configuration dialog, provide the following values: a. Name — Alert name b. Host — IP address of your USM Anywhere Sensor c. Port — 514 d. Facility — Select the appropriate facility.

e. Severity — Select the appropriate severity.

4. Click Save.

This returns you to the Alerts page.

5. To enable the alert, under Create Alert, select Enabled.

Creating Health Monitor Alerts

This procedure configures Health Monitor Alerts that use the syslog alert you just created.

199 USM Anywhere™ Deployment Guide

Supported Plugins

To configure health monitor alerts

1. Go to Policies > Actions > Alerts and select Health Monitor Alerts, which is near the top of the page.

2. Give the health alert a name.

3. Select a severity level.

Note: To select multiple severity levels, push the CTRL key at the same time you select the level.

4. From the Module column, select those health modules, for example, disk usage, that you want the USM Anywhere Sensor to receive.

5. Select the previously created syslog alert from the Alerts column.

6. Click Save.

Sending Impact Flag, Discover Event, and Malware Alerts

To send alerts with for specific types of Impact Flag, Discover, and Malware Alert events

1. Complete

Creating syslog Alerts .

2. Configure the type of events that you want to send to USM Anywhere.

a. Go to Policies > Actions > Alerts.

b. Selecting the tab for the desired alert type.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_1 l customfield_2 l customfield_3 l customfield_4 l destination_address l destination_port l destination_zone l event_action

USM Anywhere™ Deployment Guide 200

Supported Plugins l event_category l event_description l event_name l event_severity l event_subcategory l priority l rep_device_address l rep_device_hostname l rep_device_rule_id l source_address l source_port l source_username l source_zone l timestamp_occurred l timestamp_received l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.cisco.com/c/en/us/support/security/defense-center/products-tech-notes-list.html

201 USM Anywhere™ Deployment Guide

Supported Plugins

Cisco IOS

When you configure Cisco router operating system integration to send log data to USM Anywhere, you can use the Cisco IOS plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Cisco

Operating system for routers syslog https://supportforums.cisco.com/document/24661/how-configure-logging-ciscoios#Configuration_Overview

Integrating Cisco IOS

Before you configure the integration, you must have: l

The IP Address of the USM Anywhere Sensor l

Router configuration to obtain time from any NTP server

To configure Cisco IOS to send log data to USM Anywhere

1. Enter configuration mode: router# conf t

2. Configure the host to receive syslog messages: router(config)# logging host usm_anywhere_sensor_ip_address

3. Configure the host to log the desired traps: router(config)# logging traps {0 |1| 2| 3| 4 |5 ...}

4. (Optional) Specify a particular IP address for syslog messages: router(config)# logging source-interface Loopback0

5. (Optional) Display the state of system logging (syslog) and the contents of the standard system logging message buffer: router#

show logging

Example:

Syslog logging: enabled

Console logging: disabled

Monitor logging: level debugging, 266 messages logged.

Trap logging: level informational, 266 messages logged.

Logging to 10.1.1.1

USM Anywhere™ Deployment Guide 202

Supported Plugins

SNMP logging: disabled, retransmission after 30 seconds

0 messages logged router#

Plugin Enablement

The Cisco IOS plugin automatically processes all messages whose syslog tag matches the regular expression:

"(#|%)

(AAA|ACCESS|ACL|AESOP|AHDLC|ARCHIVE|ATM|ATOM|BACKPLANE|BCM|BFD|BGP|C|CALL|CAL

LTREAT|CAPI|CBUS

N|COMP|COMPILED|CONST

|CPE|CPU|CRYPTO|CSM|CWAN|CWANLC|CWTLC|DAS|DATA|DEV|DFC|DHCP|DIALPEER|DOS|DS|D

SC|DSIP|DSP|EARL|EM

FABRIC|FARM|FB|FDM

|FESMIC|FIB|FILESYS|FIO|FLEX|FM|FORCE|FPD|FPOE|FR|FRR|FS|FTC|FW|G|GBIC|GEN|GE

NERIC|GET|GK|GRP|GSR

OS|IP|IPC|IPM|IPMCAST

|ISSU|IVR|IXP|JETFIRE|LAPP|LC|LES|LRE|LSD|MAC|MARS|MARVEL|MASTER|MBUS|MCAST|M

CE|MDR|MEM|METOPT|MFIB

|MFR|MGCP|MHA|MLD|MLP|MLS|MMLS|MODEM|MOHAWK|MPLS|MR|MRIB|MWAM|MXT|NATMIB|NET|

NETFLOW|NETGX|NETWORK

|NM|NP|NSP|OER|ON|OPTICAL|OSM|PACC|PARSE|PBI|PC|PCI|PDSN|PE|PF|PIM|PLAT|PLATF

ORM|PM|POLICY|PORT|POS

|PQUICC|PW|PXF|QUICC|RADIO|RECONCILIATION|RED|REDUNDANCY|REP|RESOURCE|RF|ROUT

EMAP|RP|RPB|RPM|RPMXF

|RS|RSC|RSP|RSVP|RW|SAMI|SEC|SERIAL|SERVER|SERVICE|SFP|SGCP|SLB|SLICE|SLOT|SM

SC|SNMP|SPA|SPANTREE

IGE|TID|TINY|TOASTER

|TOPN|TRUNK|TTFIB|TWO|USB|VIP|VOICE|VPLS|VPN|WA|WIC|WLAN|WLCCP|WS|XCCTS)"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customheader_0 l destination_address l destination_port l device_inbound_interface

203 USM Anywhere™ Deployment Guide

Supported Plugins l event_description l event_name l rep_device_outbound_interface l source_address l source_port l transport_protoco

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.informit.com/library/content.aspx?b=CCNP_Studies_Troubleshooting&seqNum=20

USM Anywhere™ Deployment Guide 204

Supported Plugins

Cisco IronPort

When you configure Cisco IronPort integration to send log data to USM Anywhere, you can use the

Cisco IronPort plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Cisco

Email and web security gateway syslog http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa7-1/cli_ guide/ESA_7-1_FCS_CLI_Reference_Guide.pdf

Integrating Cisco IronPort

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

You configure the log to be pushed to a USM Anywhere Sensor, using its IP address and the UDP transport protocol. A mail facility is used and it is stored in the directory.

The following example shows how to use the logconfig command to configure a new delivery log called

MailLogSyslogPush

. with the IP address of 10.1.1.2.

To create an SCP push delivery log

1. From the mail3.example.com prompt, enter: logconfig

Currently configured logs:

1. "antispam" Type: "Anti-Spam Logs" Retrieval: FTP Poll

2. "antivirus" Type: "Anti-Virus Logs" Retrieval: FTP Poll

3. "asarchive" Type: "Anti-Spam Archive" Retrieval: FTP Poll

4. "authentication" Type: "Authentication Logs" Retrieval: FTP Poll

5. "avarchive" Type: "Anti-Virus Archive" Retrieval: FTP Poll

6. "bounces" Type: "Bounce Logs" Retrieval: FTP Poll

7. "cli_logs" Type: "CLI Audit Logs" Retrieval: FTP Poll

8. "encryption" Type: "Encryption Logs" Retrieval: FTP Poll

9. "error_logs" Type: "IronPort Text Mail Logs" Retrieval: FTP Poll

10. "euq_logs" Type: "IronPort Spam Quarantine Logs" Retrieval: FTP Poll

11. "euqgui_logs" Type: "IronPort Spam Quarantine GUI Logs" Retrieval: FTP

Poll

12. "ftpd_logs" Type: "FTP Server Logs" Retrieval: FTP Poll

13. "gui_logs" Type: "HTTP Logs" Retrieval: FTP Poll

14. "mail_logs" Type: "IronPort Text Mail Logs" Retrieval: FTP Poll

15. "reportd_logs" Type: "Reporting Logs" Retrieval: FTP Poll

16. "reportqueryd_logs" Type: "Reporting Query Logs" Retrieval: FTP Poll

17. "scanning" Type: "Scanning Logs" Retrieval: FTP Poll

205 USM Anywhere™ Deployment Guide

18. "slbld_logs" Type: "Safe/Block Lists Logs" Retrieval: FTP Poll

19. "sntpd_logs" Type: "NTP logs" Retrieval: FTP Poll

20. "status" Type: "Status Logs" Retrieval: FTP Poll

21. "system_logs" Type: "System Logs" Retrieval: FTP Poll

22. "trackerd_logs" Type: "Tracking Logs" Retrieval: FTP Poll

23. "updater_logs" Type: "Updater Logs" Retrieval: FTP Poll

Choose the operation you want to perform:

- NEW - Create a new log.

- EDIT - Modify a log subscription.

- DELETE - Remove a log subscription.

- SETUP - General2 settings.

- LOGHEADERS - Configure headers to log.

- HOSTKEYCONFIG - Configure SSH host keys.

[]>

new

Choose the log file type for this subscription:

1. IronPort Text Mail Logs

2. qmail Format Mail Logs

3. Delivery Logs

4. Bounce Logs

5. Status Logs

6. Domain Debug Logs

7. Injection Debug Logs

8. SMTP Conversation Logs

9. System Logs

10. CLI Audit Logs

11. FTP Server Logs

12. HTTP Logs

13. NTP logs

14. LDAP Debug Logs

15. Anti-Spam Logs

16. Anti-Spam Archive

17. Anti-Virus Logs

18. Anti-Virus Archive

19. Scanning Logs

20. IronPort Spam Quarantine Logs

21. IronPort Spam Quarantine GUI Logs

22. Reporting Logs

23. Reporting Query Logs

24. Updater Logs

25. Tracking Logs

26. Safe/Block Lists Logs

27. Authentication Logs

[1]>

Please enter the name for the log:

[]>

MailLogSyslogPush

Log level:

1. Critical

2. Warning

3. Information

USM Anywhere™ Deployment Guide

Supported Plugins

206

Supported Plugins

4. Debug

5. Trace

[3]>

Choose the method to retrieve the logs.

FTP Poll

2. FTP Push

3. SCP Push

4. Syslog Push

[1]>

Hostname to deliver the logs:

[]>

10.1.1.2

Which protocol do you want to use to transfer the log data?

1. UDP

2. TCP

[1]>

Which facility do you want the log data to be sent as?

1. auth

2. authpriv

3. console

4. daemon

5. ftp

6. local0

7. local1

8. local2

9. local3

10. local4

11. local5

12. local6

13. local7

14. mail

15. ntp

16. security

17. user

[14]>

Currently configured logs:

1. "MailLogSyslogPush" Type: "IronPort Text Mail Logs" Retrieval: Syslog

Push

Host 10.1.1.2

Plugin Enablement

For plugin enablement information, see

207 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l application_type l bytes_out l content_category l customfield_0 l customfield_1 l customfield_2 l customheader_0 l customheader_1 l customheader_2 l destination_address l destination_hostname l destination_ntdomain l destination_port l destination_username l event_description l event_name l event_outcome l event_severity l file_name l malware_family l malware_variant l operating_system l policy l rep_device_rule_id l rep_device_version l reputation_score l request_method l request_referrer

USM Anywhere™ Deployment Guide 208

Supported Plugins l request_url l request_user_agent l response_code l response_content_type l source_address l source_port l source_username l timestamp_occured l timestamp_received

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.cisco.com/c/dam/en/us/td/docs/security/wsa/wsa7-1/user_guide/Cisco_IronPort_

AsyncOS_7-1-0_User_Guide_for_Web_Security_Appliances.pdf

209 USM Anywhere™ Deployment Guide

Supported Plugins

Cisco Meraki

When you configure Cisco Meraki to send log data to USM Anywhere, you can use the Cisco Meraki plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Cisco

Wireless Access Point

Syslog

Integrating Cisco Meraki

To configure Cisco Meraki to send log data to USM Anywhere.

1. Open your Meraki dashboard.

2. Select a device.

3. Select Alerts & Administration.

4. Scroll down to the Logging section and click Add a syslog server.

5. Type the IP address of your USM Anywhere Sensor.

6. Type port number 514.

7. Choose which types of events to export: l

Event Log —The messages from the dashboard under Monitor > Event Log.

Flows — Inbound and outbound traffic flow-generated syslog messages that include the source, destination, and port numbers.

URL— HTTP GET requests generating syslog entries.

Note: You can direct each type of traffic to a different syslog server.

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 210

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_mac l destination_port l device_direction l device_event_category l duration l event_category l event_name l event_severity l event_subcategory l http_hostname l rep_device_rule_id l request_url l source_address l source_mac l source_port l transport_protocol l wireless_ap l wireless_channel

Additional Resources and Troubleshooting https://documentation.meraki.com/zGeneral2_Administration/Monitoring_and_Reporting/Syslog_

Server_Overview_and_Configuration

For troubleshooting, refer to the vendor documentation: http://www.informit.com/library/content.aspx?b=CCNP_Studies_Troubleshooting&seqNum=20

211 USM Anywhere™ Deployment Guide

Supported Plugins

Cisco Nexus

When you configure Cisco Nexus integration to send log data to USM Anywhere, you can use the

Cisco Nexus plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

Cisco

Switch syslog http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/ system_management/502_n1_1/b_Cisco_n5k_system_mgmt_cg_rel_502_ n1_1/Cisco_n5k_system_mgmt_cg_rel_502_n1_1_chapter9.html

Integrating Cisco Nexus

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Cisco Nexus to send log data to USM Anywhere

1. Enter configuration mode: switch# configure terminal

2. Configure the host to receive syslog messages: switch(config)# logging server { hostname

IPv4

IPv 6} [ severity-level

[ use-vrf vrf-name

[ facility facility-type

]]]

Where: l

hostname|IPv4|IPv6

identifies either the host IP, or the IPv4 or IPv6 address of the syslog server host.

severity-level

limits the logging of syslog server messages to a specified level. Severity levels range from 0 to 7.

vrf-name

identifies the default or management values for the VRF name.

If a specific VRF is not identified, management is the default.

Note: If management is configured, it does not appear in the output of the showrunning command, because it is the default. If a specific VRF is configured, the showrunning command output lists the VRF for each server.

Important: The current CFS distribution does not support VRF. If CFS distribution is enabled, then the logging server configured with the default VRF will be distributed as the management VRF.

USM Anywhere™ Deployment Guide 212

Supported Plugins l facility identifies the syslog facility type. The facilities are listed in the Cisco Nexus 5000

Series Command Reference . The default outgoing facility is local7.

2. (Optional) Remove the logging server for the specified host.

switch(config)# no logging server host

3. (Optional) Display the syslog server configuration.

switch# show logging server

4. (Optional) Copy the running configuration to the startup configuration switch# copy running-config startup-config

Example switch# configure terminal switch(config)# logging server 172.28.254.254 5 use-vrf mgmt0 facility local3

If you have a UNIX or Linux system, see the vendor documentation Configuring syslog on a UNIX or

Linux System .

Plugin Enablement

The Cisco Nexus plugin automatically processes all messages whose syslog tag matches the regular expression:

"(#|%)(AAA|AAM|ACL|ACLLOG|ACLMGR|ACLQOS|ACLTCAM|AM|ARP|ASCII|ATIMERS|BGP|BIOS_

PORT_LB|DMM|DOT1X|DPP_

SB_MGR|IPv6|IPV6|ISAPI|ISIS|ISNS|IVR|KSINK|L2FM|L2FMC|L2MCAST|L3VM|LACP|LC|LC_

CFG|LC_PORT_CHANNEL|LC_PORT_MGR|LC_RDL|LIBBASE_

SDP|NFM|NFP|NPC|NPV|NTP|NVP|OC_USD|ORI_MAC|OSPF|OTM|PHY_

MGR|PSS|PT|QOS|RADIUS|RDL|REGEX|RES_MGR|RIB|RIP|RLIR|RM|RPM|RSCN|SAL|SAN_EXT_

USD|SLAB_LIB|SME_CPP|SMM|SNMPD|SPAN|SPI|STP|SVC|SVC_

BATTERY|SYSLOG|SYSMGR|SYSTEMHEALTH|SYSWRAP_

MGR|VEC|VEDB_MGR|VES|VFC|VIM|VLAN_MGR|VNI|VOMD|VPC|VPM|VRRP|VRRP_CFG|VRRP_

213 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_port l event_description l event_name l source_address l source_port l source_username

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://docwiki.cisco.com/wiki/Cisco_Nexus_7000_Series_NX-OS_Troubleshooting_Guide

USM Anywhere™ Deployment Guide 214

Supported Plugins

Cisco PIX

When you configure Cisco PIX to send log data to USM Anywhere, you can use the Cisco PIX plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Cisco

Firewall

Syslog

Integrating Cisco PIX

Before you configure the Cisco PIX integration, you must have the IP Address of the USM

Anywhere Sensor.

To configure Cisco PIX to send log data to USM Anywhere

1. Connect to the PIX system and enter:

CONFIG T

2. Enable logging: logging on logging trap debugging logging host {inside|outside|xi} <IP address of the USM Anywhere Sensor> no logging timestamp

3. Press Ctrl+Z to exit config mode.

4. Save the configuration changes: write mem

Setting the Syslog Logging Level for Cisco devices

All Cisco devices that support Syslog collection and output of system messages typically let you set a logging level which determines the type and severity of the messages that are sent to a Syslog host such as USM Anywhere for processing and analysis. The following table describes the broad classification of each of these logging levels.

Logging Level

Keyword/Severity Level

emergency

Description

System is unusable. Typically devices do not generate

Sylog messages with a severity/logging level of 0.

215 USM Anywhere™ Deployment Guide

Supported Plugins

7 alert critical error warning notification informational debugging

Warning condition or event. These messages are generally warnings about connection problems. An administrator might have to follow up on these warning messages.

USM Anywhere™ Deployment Guide 216

Supported Plugins

Note: Refer to the vendor documentation provided for your specific device, on the logging commands that are available, and how to use them to control Syslog message output.

Plugin Enablement

The Cisco PIX plugin will automatically process all messages whose syslog tag matches the following regular expression:

"%PIX-"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l audit_reason l customfield_0 l customfield_1 l customheader_0 l customheader_1 l destination_address l destination_nat_address l destination_nat_port l destination_port l destination_username l device_inbound_interface l duration l email_recipient l event_action l event_description l event_name l event_outcome l group_policy

217 USM Anywhere™ Deployment Guide

l rep_device_outbound_interface l rep_device_rule_id l request_url l security_group_name l source_address l source_nat_address l source_nat_port l source_port l source_process_commandline l source_username l transaction_status

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-5/command/reference/cr75.pdf

http://www.ciscopress.com/articles/article.asp?p=424447&amp;seqNum=2

Supported Plugins

USM Anywhere™ Deployment Guide 218

Supported Plugins

Cisco SourceFire IDS

When you configure Cisco SourceFire IDS integration to send log data to USM Anywhere, you can use the Cisco SourceFire IDS plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Resource link

Details

Cisco

Intrusion detection system (IDS) syslog http://www.cisco.com/c/en/us/support/docs/security/firesight-managementcenter/118464-configure-firesight-00.html

SourceFire Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

Sending Intrusion Alerts

To configure Cisco SourceFire to send intrusion alerts to USM Anywhere

1. Log into the web interface of the SourceFire IDS.

2. Go to Policies > Intrusion > Intrusion Policy.

3. Locate the policy you want to apply and select Edit.

4. Click Advanced Settings.

5. In the list, locate Syslog Alerting and set it to Enabled.

6. In the Logging Hosts field, type the IP address of your USM Anywhere Sensor.

7. Choose an appropriate Facility and Severity from the listbox.

Note: You may leave these at their default values unless a syslog server is configured to accept alerts for a certain facility or severity.

8. Near the top-left of the page, click Policy Information.

9. Click Commit Changes.

10. Reapply your intrusion policy.

219 USM Anywhere™ Deployment Guide

Supported Plugins

Sending Health Alerts

To send health alerts

1. Log into the web user interface.

2. Navigate to Policies > Actions > Alerts.

3. Create a new syslog alert by clicking Create Syslog Alert.

a. In the Name field, provide a name for the alert.

b. In the Host field, type the IP address of your USM Anywhere Sensor.

Note: The default syslog port is 514, so you needn't edit the Port field.

c. Select an appropriate Facility and Severity.

d. Click Save.

This returns you to the Alerts page.

4. Under Create Alert, select Enabled.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customfield_1 l customfield_2 l customheader_0 l customheader_1 l customheader_2 l destination_address l destination_port l event_action l event_description l event_name l source_address

USM Anywhere™ Deployment Guide 220

Supported Plugins l source_port l rep_device_address l rep_device_hostname l rep_device_rule_id l rep_device_type l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118159troubleshoot-firesite-00.html

221 USM Anywhere™ Deployment Guide

Supported Plugins

Cisco StealthWatch

When you configure Cisco StealthWatch integration to send log data to USM Anywhere, you can use the Cisco StealthWatch plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Cisco

Intrusion detection

Syslog https://www.lancope.com/wiki/integrating-stealthwatch-alarms-siem

Integrating Cisco StealthWatch

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

Cisco StealthWatch must be configured to forward log data over syslog to USM Anywhere in CEF format.

To configure Cisco StealthWatch to forward log data to USM Anywhere

1. Select the Domain or any Host Group.

2. Open the Configuration menu and select Response Management.

3. From the Actions section in the Response Management menu, select Add and then ArcSight

Common Event from the Action Types list.

4. Provide a name, for example, USM Anywhere Sensor, and add its IP address and its port (514, in most cases).

Note: Selecting Test sends a test message to the sensor for validation.

5. Select OK to finish.

6. From the Rule option in the Response Management menu, select Add.

7. From the Rule Types list, select Host Alarm.

8. From the Add Host Alarm Rule option, set a rule name and add the alarm conditions you want forwarded to the rule.

Note: Pay close attention to set the following "are true" section correctly.

9. To add a condition (Type, Severity, Source Host, Target Host or Processing Time) select the ellipses (…) button, and then select the desired type(s).

USM Anywhere™ Deployment Guide 222

Supported Plugins

Note: For a host alarm, best practice is to combine as many types as possible in an

Any statement.

In the current example, an event will be forwarded to ArcSight if

Addr_Scan/tcp, Addr_

Scan/udp, Bot Infected Host – Successful C&C Activity, or

Data Hoarding is detected.

10. From the Actions dialog, select the USM Anywhere Sensor syslog action for both Active and

Inactive conditions.

If the defined conditions occur, the event will be forwarded to USM Anywhere.

Plugin Enablement

For plugin enablement information, see

About AWS Sensor Deployment

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_2= l customfield_3= l customheader_2= l customheader_3= l customheader_4= l customheader_5= l destination_address= l destination_port= l event_description= l event_name= l event_severity= l external_id= l plugin_device= l plugin_device_type= l rep_device_address=

223 USM Anywhere™ Deployment Guide

l rep_device_rule_id= l rep_device_type= l rep_device_vendor= l rep_device_version= l source_address= l time_start= l transport_protocol=

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.cisco.com/c/en/us/support/security/stealthwatch-flow-collector-series/tsd-productssupport-troubleshoot-and-alerts.html

Supported Plugins

USM Anywhere™ Deployment Guide 224

Supported Plugins

Cisco Umbrella

When you configure Cisco Umbrella (formerly, OpenDNS) integration to send log data to USM

Anywhere, you can use the Cisco Umbrella plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Cisco

Antivirus

S3 https://support.umbrella.com/hc/en-us/articles/231248448

Before you can enable the Cisco Umbrella plugin to collect log data, you must enable Amazon S3 log management in your Cisco Umbrella deployment. This requires that you have an S3 bucket in your AWS account that is configured to accept uploads from the Umbrella Service. For detailed information about this configuration, refer to the following article: https://support.umbrella.com/hc/en-us/articles/231248448-Cisco-Umbrella-Log-Management-in-

Amazon-S3

To verify Amazon S3 log management in Cisco Umbrella

1. Log into the Cisco Umbrella (OpenDNS) dashboard.

2. Navigate to Settings > Log Management.

3. Click Amazon S3.

4. In the Bucket Name field, enter the exact S3 bucket name.

5. Click Verify.

A confirmation message in the dashboard will indicate that the bucket was successfully verified.

225 USM Anywhere™ Deployment Guide

Supported Plugins

Plugin Enablement

This procedure configures the Cisco Umbrella (formerly, OpenDNS) plugin to send log data to a

USM Anywhere AWS sensor. By design, Cisco Umbrella will only export log data to a AWS S3 bucket; therefore, accessing this data requires a deployed AWS sensor.

To schedule an S3 bucket log collection job with the Cisco Umbrella plugin

1. In the USM Anywhere web UI, go to SETTINGS > DEPLOYMENT and click Amazon Web

Services on the left under Sensor Apps.

Note: The Amazon Web Services Sensor App appears on the Deployment page only if you have a deployed AWS sensor. If you want to deploy this sensor to facilitate Cisco

Umbrella integration, see

2. Click the ACTIONS tab in the displayed page.

3. Click Schedule Job at the top-right of the page.

This opens the Schedule New Job dialog, where you can specify the parameters for automatic log collection. The Select Sensor and Select App options are already set for you.

USM Anywhere™ Deployment Guide 226

Supported Plugins

4. Enter the Name and Description for the job.

The description is optional, but it is a best practice to provide this information so that others can easily understand what it does.

5. For the App Action option, select Monitor S3 bucket.

6. In the Bucket Name field, enter the name of the S3 bucket that is configured in Cisco Umbrella log management.

7. In the Path field, enter the path on the bucket where the logs reside ( in this case, dnslogs/

8. For the Source Format option, select raw.

9. For the Plugin option, select Cisco Umbrella.

227

10. Set the Schedule to specify when USM Anywhere runs the job.

First, choose the increment as Hour, Day, Week, Month, or Year. Next, set the interval options for the increment. The selected increment determines the available options.

USM Anywhere™ Deployment Guide

For example, on a weekly increment you can select the days of the week to run the job.

Supported Plugins

Or, on a monthly increment you can specify a specific date or a day of the week that occurs within in the month.

To finish, set the Start time. This is the time that the job starts at the specified interval. It uses the time zone configured for your USM Anywhere instance (default is UTC).

11. Click Save.

You should start seeing new events in USM Anywhere from the plugin shortly after enablement and raw log data download.

When events start appearing in the Events dashboard view, the Cisco Umbrella dashboard is available under DASHBOARDS in the top navigation bar. This dashboard summarizes events originating from Cisco Umbrella so that you see what's going on at a glance.

USM Anywhere™ Deployment Guide 228

Supported Plugins

229

Available Plugin Fields

The Cisco Umbrella plugin provides support for multiple fields, which are important attributes extracted from the message. These fields are used in USM Anywhere reports and can be referenced when creating custom reports. In addition to reporting, the fields are also used by the

USM Anywhere correlation rules.

Note: The custom fields are prefilled according to the values described. You cannot change them.

l source_zone l security_group_name l content_category l dns_rcode l dns_rrname l dns_rrtype l event_action l event_name l plugin_device l rep_device_hostname l security_group_name l source_address l source_nat_address l customfield_1 → Resource Type ID*

USM Anywhere™ Deployment Guide

l customfield_2 → Resource Type Description* l customheader_1

‡ l customheader_2

‡

----------------------------

* customfield_1 and

2 contain the actual values for Resource Type ID and Resource Type

Description.

‡ customheader_1 and

2 contain the words Resource Type ID and Description.

Troubleshooting

For troubleshooting, refer to the vendor documentation:

Cisco Umbrella Knowledge Base

Supported Plugins

USM Anywhere™ Deployment Guide 230

Supported Plugins

Cisco WLC

When you configure Cisco Wireless LAN Controller (WLC) to send log data to USM Anywhere, you can use the Cisco WLC plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Cisco

Wireless access point manager

Syslog

Integrating Cisco Wireless LAN Controller

Before you configure the Cisco WLC integration, you must have the IP Address of the USM

Anywhere Sensor.

Note: This command supports both IPv 4 and IPv6 address formats.

To configure a remote host to send syslog messages

1. After connecting to the Cisco WLC console, enter enable mode.

2. Configure the remote host to send syslog messages to USM Anywhere: config logging syslog host <IP address of the USM Anywhere Sensor>

Example

(Cisco Controller)> config logging syslog host 10.92.125.52

Cisco log will be sent to 10.92.125.52 from now on.

3. Set the facility for outgoing syslog messages to the remote host:

(Cisco Controller)> config logging syslog facility syslog

Example

(Cisco Controller)> config logging syslog facility authorization

4. Set the severity level for filtering syslog messages to the remote host at informational:

(Cisco Controller)> config logging syslog level 6

Setting the Syslog Logging Level for Cisco devices

All Cisco devices that support Syslog collection and output of system messages typically let you set a logging level which determines the type and severity of the messages that are sent to a Syslog host such as USM Anywhere for processing and analysis. The following table describes the broad classification of each of these logging levels.

231 USM Anywhere™ Deployment Guide

Supported Plugins

Logging Level

Keyword/Severity Level

emergency

7 alert critical error warning notification informational debugging

Description

System is unusable. Typically devices do not generate

Sylog messages with a severity/logging level of 0.

Warning condition or event. These messages are generally warnings about connection problems. An administrator might have to follow up on these warning messages.

USM Anywhere™ Deployment Guide 232

Supported Plugins

Note: Refer to the vendor documentation provided for your specific device, on the logging commands that are available, and how to use them to control Syslog message output.

Plugin Enablement

The Cisco WLC plugin will automatically process all messages whose syslog tag matches the following regular expression:

"(#|%)

(AAA|ACL|APF|AUTOINST|AVL|BASE|BCAST|BOOTP|BUFF|CAPWAP|CCX|CDP|CIDS|CLI|CLIWE

P|IDMGR|INIT|IOS|IPSTAT|LAG|LICENSE|LOCP|LOG|LRADSIM|LWAPP|MIRROR|MM|MMC|NIM|

|WCP|WEB|WPS)"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l audit_reason l destination_address l destination_hostname l destination_mac l destination_user_privileges l destination_username l device_facility l event_description l event_name l event_outcome l event_severity l file_path

233 USM Anywhere™ Deployment Guide

Supported Plugins l source_address l source_mac l source_process

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-5/command/reference/cr75.pdf

https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/troubleshooting/trb-guide-wlc-

5520-8540.html

USM Anywhere™ Deployment Guide 234

Supported Plugins

Citrix NetScaler

When you configure Citrix NetScaler to send log data to USM Anywhere, you can use the Citrix

NetScaler plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Citrix

Load balancer

Syslog

Integrating Citrix NetScaler

Before you configure the Citrix NetScaler integration, you must have the IP Address of the USM

Anywhere Sensor.

To configure Citrix NetScaler to send log data to USM Anywhere

1. Log into the Citrix NetScaler console as administrator.

2. From the task bar, select Configuration.

3. Select a configuration utility.

4. In the navigation pane, expand the System folder.

5. Select Auditing.

6. In the Settings section, select Change global audit settings.

7. In Configure Auditing Parameters, set the parameters as described: a. In the Auditing Type field, select SYSLOG.

b. In IP Address, enter the IP address of the USM Anywhere Sensor.

c. In Port Number, enter 514.

d. In Log Levels, select All.

e. From the Log Facility list, select the appropriate facility.

f. For Time Zone, select GMT.

g. Select TCP Logging.

h. Select ALC Logging.

8. Click Save.

9. When prompted, click Yes to save the configuration.

Plugin Enablement

For plugin enablement information, see

235 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l app_name l audit_reason l bytes_in l bytes_out l destination_address l destination_nat_address l destination_username l duration l event_description l event_name l event_outcome l event_severity l rep_device_address l rep_device_hostname l request_url l security_group_name l source_address l source_port l source_process_commandline l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://support.citrix.com/article/CTX121728 https://docs.citrix.com/en-us/netscaler-insight/11-0/ni-troubleshoot-tips-ref.html

USM Anywhere™ Deployment Guide 236

Supported Plugins

Citrix NetScaler Application Firewall

When you configure Citrix NetScaler Application Firewall to send log data to USM Anywhere, you can use the Citrix NetScaler Application Firewall plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Citrix

Application firewall

Syslog https://support.citrix.com/article/CTX138973

Citrix NetScaler Application Firewall Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Citrix NetScaler Application Firewall to send log data to USM Anywhere

1. Update the

/etc/syslog.conf

file and add the following line in the file: add audit syslogAction sysaction <usm_anywhere_ip> -logLevel ALL logFacility 3

2. Run the following command to add syspol1 policy, which uses sysact1 server: add audit syslogPolicy syspol1 ns_true sysact1

3. Run the following command to bind the Application Firewall policy and ensure that it is saved in ns.conf file: bind appfw global syspol1 100

Plugin Enablement

For plugin enablement information, see

Creating a New AWS S3 Access Collection Job

237 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l device_custom_number_1 l device_custom_number_2 l event_action l event_description l event_name l event_ref_id l event_severity l policy l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l request_method l request_url l source_address l source_port

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://support.citrix.com/article/CTX140153

USM Anywhere™ Deployment Guide 238

Supported Plugins

CloudFront RTMP, Distribution W3C

When you configure CloudFront RTMP to send log data to an S3 bucket, you can use the

CloudFront RTMP plugin to collect the raw log data in USM Anywhere and translate it into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

Amazon

Dynamic content storage and streaming

S3 http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/

AccessLogs.html#access-logs-choosing-s3-bucket

Integrating CloudFront RTMP

When you enable logging for a distribution, you specify the Amazon S3 bucket that you want

CloudFront to use for file storage.

Plugin Enablement

Follow the procedure described in

, choosing

CloudFront RTMP for the plugin to monitor the S3 bucket.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l bytes_in l customfield_0 → cs-uri-stem* l customfield_1 → cs-uri-query* l customfield_2 → c-cf-status

‡ l customfield_3 → x-cf-client-id

‡ l event_name l request_referer l request_url

239 USM Anywhere™ Deployment Guide

l request_user_agent l source_address l timestamp_occurred

* customfield_0 and

1 contain the actual values for cs-uri-stem and cs-uri-query

‡ customfield_2 and

3 contain the actual values for c-cf-status and x-cf-client-id

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Troubleshooting.html

Supported Plugins

USM Anywhere™ Deployment Guide 240

Supported Plugins

CloudFront WEB

When you configure CloudFront WEB to send log data to an S3 bucket, you can use the CloudFront

WEB plugin to collect the raw log data in USM Anywhere and translate it into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Amazon

Dynamic content storage and streaming

Syslog http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/

AccessLogs.html#access-logs-choosing-s3-bucket

CloudFront WEB Integration

When you enable logging for a distribution, you specify the Amazon S3 bucket in which you want

CloudFront WEB to store log files.

Plugin Enablement

To enable CloudFront WEB, perform the procedure

Creating a New AWS S3 Access Collection Job

and select CloudFront WEB as the plugin.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l bytes_in l bytes_out l customfield_2 → edge-request-id* l destination_address l duration l event_name l http_hostname l http_referer

241 USM Anywhere™ Deployment Guide

l request_coockies l request_http_version l request_method l request_referer l request_url l request_user_agent l response_code l response_content_type l source_address l timestamp_occurred l tls_cipher l tls_version

* customfield_2 contains the word edge-request-id

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Troubleshooting.html

Supported Plugins

USM Anywhere™ Deployment Guide 242

Supported Plugins

CloudPassage Halo

When you configure CloudPassage Halo integration to send log data to USM Anywhere, you can use the CloudPassage Halo plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

CloudPassage

Unified threat management syslog

See the Common Event Format Configuration Guide for Python on https://github.com/cloudpassage/halo-event-connector-python

Integrating CloudPassage Halo

Before you configure the integration, you must have: l

Reachability of the USM Anywhere Sensor l

IP address of the USM Anywhere Sensor l

Access to your CloudPassage API key l

Python 2.6 or above l

Event Connector script and its associated files

The Event Connector retrieves events from your CloudPassage Halo account by making calls to the

CloudPassage API. The API requires the script to authenticate itself during every session. For this purpose, you must make your CloudPassage API Key available to the script.

To configure CloudPassage Halo to send log data over syslog to USM Anywhere

1. Place all the halo-event-connector script files in the same location. These consist of the following: l haloEvents.py

l cpapi.py and cputils.py

(Windows users only) remote_syslog.py

2. Create a file called haloEvents.auth

and place it in the same location as the other files.

243 USM Anywhere™ Deployment Guide

Supported Plugins

3. Retrieve and save your CloudPassage API key by following these steps: a. Log into the CloudPassage Portal.

b. Go to SETTINGS > Site Administration and click the API Keys tab. If you haven’t generated an API key yet, do so by clicking Add New Key.

If you do create an API Key, we recommend that you make the permission Read Only, as a best practice. You don't need a higher permission for this purpose.

c. To retrieve both the Key ID and the Secret Key values for the API key, on the API Keys tab, display both values by clicking Show.

d. Copy both and paste them into the empty haloEvents.auth

file, as just one line, with the key ID and the secret separated by a vertical bar ("|"):

<your_key_id>|<your_secret_key>

Note: If you want to stream events from multiple Halo accounts, add one additional line to this file for each account, containing the account's key ID and secret key, formatted as shown.

3. Configure your syslog daemon to forward the logs retrieved to the USM Anywhere Sensor, using one of thefollowing methods.

Linux/Mac OSX users

Check for the appropriated syslog configuration file, and add and save your USM Anywhere

Sensor IP address to it: ls –d /etc/*syslog*

USM Anywhere™ Deployment Guide 244

Supported Plugins

MS Windows users

Edit the remote_syslog.py

file and replace

... host='localhost' ...

in the file with

...

host='<usm-anywhere-ip/hostname>'

....

4. Launch the script using the following flags: haloEvents.py --cefsyslog --port=514

Where: l

--cefsyslog

= Outputting the log data in the format supported by the plugin.

--port=514

= (Optional) Configures the UDP port to be 514, if that is not the number you currently use for UDP.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l bytes_in l destination_address l destination_fqdn l destination_hostname l destination_port l device_direction l event_action l event_description l event_name l event_receipt_time l event_severity l operating_system l policy l rep_device_address

245 USM Anywhere™ Deployment Guide

Supported Plugins l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l source_address l source_port l transient l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://api-doc.cloudpassage.com/help

CrowdStrike Falcon

When you configure CrowdStrike Falcon SIEM Connector integration to send log data to USM

Anywhere, you can use the CrowdStrike Falcon plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

CrowdStrike

Endpoint Security syslog https://www.crowdstrike.com/blog/tech-center/setup-crowdstrike-falcon-siemconnector/

Integration Prerequisites l

IP Address of the USM Anywhere sensor l

OS: CentOS/RHEL 6.x-7.x (64-bit) l

Connectivity: Internet connectivity and ability to connect the CrowdStrike Cloud (HTTPS/TCP

443) l

Time: The date and time on the host running the CrowdStrike Falcon SIEM Connector must be current (use NTP)

USM Anywhere™ Deployment Guide 246

Supported Plugins

Configuring CrowdStrike Falcon SIEM Connector

To configure CrowdStrike Falcon SIEM Connector to send log data to USM Anywhere

1. Download the rpm install packages for the SIEM Connector from the Crowdstrike Falcon website. You may also want to download the latest documentation package to have the “Falcon

SIEM Connector Feature Guide” available as a reference.

2. Unzip the package and make sure you see the following file1: cs.falconhoseclient-x.x.x-x.el7.centos.x86_64.rpm

3. Using a file transfer tool, transfer the file to your Linux server and place it in

/opt

4. Connect to the Linux server through SSH.

Important: When installing the SIEM Connector, you must login as the root user.

5. Type the following commands to install the connector: cd /opt rpm -Uvh cs.falconhoseclient-1.0.32-1.el7.centos.x86_64.rpm

The installer creates a new directory, /opt/crowdstrike, with three sub directories: l bin/

, holds the binary of the actual service, as well as the api offset file l etc/

, holds the configuration file(s) l log/

, holds the log file as well as the default local output file

6. Configure the SIEM Connector to send logs in CEF format to USM Anywhere syslog server: l

Rename /opt/crowdstrike/etc/cs.falconhoseclient.cef.cfg to /opt/crowdstrike/etc/cs.falconhoseclient.cfg.

In cs.falconhoseclient.cfg, set the following parameters: output_format = syslog output_to_file = false send_to_syslog_server = true host = <USM_Anywhere_IP_address> port = 514 prococol = udp

7. Save your configuration file.

8. Start the SIEM Connector service with the following command:

/etc/init.d/cs.falconhoseclientd start

247

The name of the file will depend on the rpm install packages that you have downloaded.

You might have to adjust the file name depending on the version of the SIEM Connector you are installing.

USM Anywhere™ Deployment Guide

Supported Plugins or service cs.falconhoseclientd start

9. Verify your setup is correct and your connectivity is established: tail -f /opt/crowdstrike/log/cs.falconhoseclient.log

Plugin Enablement

The CrowdStrike Falcon plugin will automatically process all messages whose Syslog message contains the value CrowdStrike|FalconHost.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_hostname l destination_port l device_custom_number_3 l device_custom_number_3_label l event_description_url l event_name l event_severity l file_name l file_path l plugin_device l plugin_device_type l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l source_address l source_hostname l source_ntdomain l source_port

USM Anywhere™ Deployment Guide 248

Supported Plugins l source_process_commandline l source_process_id l source_username

Troubleshooting

For troubleshooting, see the vendor documentation.

249 USM Anywhere™ Deployment Guide

Supported Plugins

CylancePROTECT

When you configure CylancePROTECT integration to send log data to USM Anywhere, you can use the CylancePROTECT plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

Cylance

Endpoint security syslog

For information, see the vendor website.

Integrating CylancePROTECT

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure CylancePROTECT to send log data over syslog to USM Anywhere

1. From Cylance, go to Settings > Application.

2. In the Integrations section, select Syslog/SIEM.

3. Under Event Types, select all available events.

4. For SIEM, select AlienVault as the destination.

5. For Protocol, select UDP.

6. On IP/DOMAIN, type the IP address of the USM Anywhere Sensor, and use 514 as the port number.

7. For Severity, select Debug (1).

8. For Facility, select Internal (5).

9. Click Save.

Plugin Enabement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 250

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l affected_platform l audit_reason l device_event_category l event_action l event_category l event_name l event_outcome l file_hash l file_hash_algorythm l file_name l file_path l file_type l group_policy l malware_family l malware_variant l reputation_score l source_address l source_hostname l source_mac l source_zone l customfiled_0 → Drive Type l customfiled_2 → Is Running l customfiled_3 → Auto Run l customfiled_4 → Detected By

251 USM Anywhere™ Deployment Guide

l customfiled_5 → Agent Version l customfiled_6 → Interpreter l customfiled_7 → Interpreter Version l customfiled_8 → Logged On Users l customfiled_9 → IP Address l customfiled_10 → MAC Address List l customfiled_11 → Device Names l customfiled_12 → Found Date l customfiled_13 → Added to l customfiled_14 → Device Message

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://support.cylance.com/hc/en-us

Supported Plugins

USM Anywhere™ Deployment Guide 252

Supported Plugins

Cyphort

When you configure Cyphort integration to send log data to USM Anywhere, you can use the

Cyphort plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor documentaton

Details

Cyphort

Unified Threat Management syslog

See the Cyphort CEF & Syslog Support for SIEM Reference on the vendor's

Support web pages.

Integrating Cyphort

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Cyphort to send log data to USM Anywhere

1. From the Cyphort web UI, go to Config > Notifications > SIEM Settings.

2. Indicate the following parameters (shown in the following illustration): l

Data types to forward l

CEF format l

All malware l

Trigger l

Days and dates that trigger data forwarding

3. In the Hostname field, add the IP address of the USM Anywhere Sensor.

4. In the Port number field, type 514 for UDP transport.

On the host name field add the AlienVault USM Anywhere Sensor IP, and in the port number field the port 514.

253 USM Anywhere™ Deployment Guide

Supported Plugins

5. Click Save.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_hostname l destination_username l event_action l event_description l event_name l event_receipt_time l event_ref_id l event_severity l file_name l file_type l file_owner l http_referer l malware_family

USM Anywhere™ Deployment Guide 254

Supported Plugins l malware_variant l request_url l source_address l source_hostname l source_usename l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://support.cyphort.com/support/home

255 USM Anywhere™ Deployment Guide

Supported Plugins

Dell SonicWALL

When you configure Dell SonicWALL to send log data to USM Anywhere, you can use the Dell

SonicWALL plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Dell

Firewall

Syslog

Integrating Dell SonicWALL

Before you configure the Dell SonicWALL integration, you must have the IP Address of the USM

Anywhere Sensor.

To configure Dell SonicWALL to send log data to USM Anywhere

1. After logging into the SonicWALL console as the administrator, go to Firewall > Address

Objects.

2. Select Add New Address Object.

3. In the Add Address Object dialog, complete the following and click OK: a. Name — USM Anywhere b. Zone Assignment — LAN c. Type — Host d. IP Address — IP address of the USM Anywhere Sensor

4. Go to LOG > Settings.

5. Under SYSLOG Servers, select ADD.

a. Name or IP address should match the USM Anywhere Sensor.

b. Port should be 514.

c. For Bind to VPN Tunnel and Create Network Monitor Policy in NDPP Mode, select the appropriate local and outbound interfaces.

3. Click OK and Done.

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 256

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l bytes_in l bytes_out l content_category l destination_address l destination_hostname l destination_port l device_event_category l device_inbound_interface l device_outbound_interface l event_description l event_name l event_severity l policy l rep_device_address l rep_device_rule_id l request_url l response_code l session l source_address l source_mac l source_port l source_username l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://support.software.dell.com/kb/sw5106 https://support.software.dell.com/kb/sw13547

257 USM Anywhere™ Deployment Guide

Supported Plugins

ELB Access

When you configure Amazon Elastic Load Balancer (ELB) Access to send log data to an S3 bucket, you can use the ELB Access plugin to collect the raw log data in USM Anywhere and translate it into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Amazon

Load balancer

Syslog http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enableaccess-logs.html

ELB Access Integration

To configure ELB Access to send log data to USM Anywhere

1. Create an S3 bucket: a. Open the Amazon S3 console at https://console.aws.amazon.com/s3

b. Choose Create Bucket.

c. On the Create a Bucket page, do the following: l

For Bucket Name, enter a name for your bucket.

For Region, select the region where you created your load balancer.

Choose Create.

2. Attach a policy statement to your bucket: a. Open the Amazon S3 console at https://console.aws.amazon.com/s3/ .

b. Select the bucket, and then choose Properties.

c. For Permissions, choose Add bucket policy.

d. On the Bucket Policy Editor page, choose AWS Policy Generator.

e. On the AWS Policy Generator page, do the following: i. For Select Type of Policy, select S3 Bucket Policy.

ii. For Effect, select Allow to allow access to the S3 bucket.

iii. For Principal, type the account ID for Elastic Load Balancing to grant Elastic Load

USM Anywhere™ Deployment Guide 258

Supported Plugins

Balancing access to the S3 bucket.

Use the account ID that corresponds to the region for your load balancer and bucket.

iv. For Actions, select PutObject to allow Elastic Load Balancing to store objects in the S3 bucket.

v. For Amazon Resource Name (ARN), type the ARN of the S3 bucket in the following format: arn:aws:s3:::bucket/prefix/AWSLogs/aws-account-id/* vi. Choose Add Statement, Generate Policy.

vii. Copy the policy displayed in the Policy JSON Document page, and then choose

Close.

f. Return to the Bucket Policy Editor page and paste the policy into the text area.

g. Choose Save to save the policy. If Save is not enabled, press Enter.

h. For Permissions, choose Save to attach the policy to your bucket.

3. Enable Access Logs: a. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/ .

b. On the navigation pane, under LOAD BALANCING, choose Load Balancers.

c. Select your load balancer.

d. On the Description tab, for Access logs, choose (Edit).

e. On the Configure Access Logs page, do the following: i. Select Enable access logs.

ii. Set the interval (default = 60 minutes).

iii. For S3 location, type the name of your S3 bucket, including the prefix.

iv. Choose Save.

Plugin Enablement

To schedule a log collection job for an S3 bucket

1. From the primary task bar, go to SETTINGS > DEPLOYMENT.

2. In the left-most panel, select AWS > ACTIONS.

3. Click SHEDULE JOB.

259 USM Anywhere™ Deployment Guide

Supported Plugins

4. Fill out the form, as you would otherwise, but in the Plugin list, select ELBAccess plugin to monitor the S3 bucket.

5. Click Save.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l application_protocol l bytes_in l bytes_out l customfield_0 → Request Processing Time l customfield_1 → Backend Processing Time l customfield_2 → Response Processing Time l customfield_3 → Load Balancer Status Code l destination_address l destination_port l event_action l event_description l event_name l plugin_device l plugin_device_version l protocol_version l rep_device_hostname l request_method l request_url l request_user_agent l response_code l source_address l source_address_6 l source_port l tls_cipher l tls_version

USM Anywhere™ Deployment Guide 260

Supported Plugins

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-troubleshooting.html

261 USM Anywhere™ Deployment Guide

Supported Plugins

ESET Antivirus

When you configure ESET integration to send log data to USM Anywhere, you can use the ESET plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

ESET

Antivirus

Syslog http://help.eset.com/era_admin/63/en-US/index.html?admin_server_

settings_export_to_syslog.htm

Integrating ESET Antivirus

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure ESET to send log data to USM Anywhere

1. After logging into the ESET Remote Administrator (ERA) web console, in the left navigation bar, select the Administrator icon (looks like a tool box), then Server Settings > ADVANCED

SETTINGS.

2. In the Syslog Server section of Server Settings, configure the following a. Toggle the Use Syslog server slider to display a checkmark.

b. Host — IP address of the USM Anywhere Sensor.

c. Port — 514

3. In the Logging section, toggle the Export logs to Syslog slider to display a checkmark.

4. Click SAVE.

Format and Meaning of Exported Event Attributes

ESET Remote Administrator can export certain logs/events and send them to the USM Anywhere

Sensor. Events are generated on a managed client computer running ESET security product (for example, ESET Endpoint Security) and consist of events like the following: l

ThreatEvent l

Firewall Aggregated Event l

HIPS Aggregated Event

Any Security Information and Event Management (SIEM) solution capable of importing events from a Syslog server can process these events. They are then written to the designated USM Anywhere

Sensor.

USM Anywhere™ Deployment Guide 262

Supported Plugins

To view JSON-formatted event messages in ESET Remote Administrator l

After you enable the Syslog server, go to Admin > Server Settings > Syslog Server > Logging and enable Export logs to Syslog.

Event messages are formatted as JavaScript Object Notation (JSON) objects with some mandatory and optional keys.

The table illustrates the format and meaning of all exported events. Each exported even contains the following:

Attribute format event_ type ipv4

String Optional? Exported Event Type ipv6 string string source_uuid string

✓

IPv4 address of the computer generating the event.

IPv6 address of the computer generating the event.

UUID of the computer generating the event.

occurred string severity string

UTC time of occurrence of the event. Format is %d-%b-%Y

%H:%M:%S

Severity of the event. Possible values (least severe - most severe): l

Information l

Notice l

Warning l

Error l

Critical l

Fatal

Firewall Aggregated Event

Firewall aggregated events event_type source_address source_address_type source_port string

✓

✓ integer

Optional?

✓

Event Name

Address of the event source

Type of address of the event source

Port of the event source

263 USM Anywhere™ Deployment Guide

Supported Plugins

Firewall aggregated events (Continued) event_type target_address target_address_type target_port protocol account process_name rule_name rule_id inbound threat_name aggregate_count string

✓

Integer

✓

Boolean

✓

Integer

✓

Optional?

✓

Event Name

Address of the event destination

Type of address of the event destination

Port of the event destination

Protocol

Name of the user account associated with the event

Name of the process associated with the event

Rule name

Rule ID

Whether or not the connection was inbound

Name of the threat

Number of identical messages generated by the endpoint within two consecutive replications between ERA Server and managing ERA Agent

HIPS Aggregated Events

The plugin filters events from the host-based Intrusion Prevention System based on severity before sending them as Syslog messages. The plugin only sends events with severity levels Error, Critical, and Fatal to Syslog.

HIPS-specific attributes

Application string operation target

✓

✓ action rule_name

✓

Optional?

Application Name

✓

Operation

Target

Action

Rule name

USM Anywhere™ Deployment Guide 264

Supported Plugins

265

HIPS-specific attributes (Continued)

Application string rule_id ✓ aggregate_ count

Integer

Optional?

Application Name

✓ Rule ID

✓ Number of identical messages generated by the endpoint within two consecutive replications between ERA Server and managing ERA Agent

Plugin Enablement

The ESET plugin automatically processes all messages whose Syslog tag matches the value

"ERAServer".

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l customfield_1 l customfield_10 l customfield_12 l customfield_2 l customfield_3 l customfield_4 l customfield_6 l customfield_7 l customfield_8 l customfield_9 l customheader_10 l customheader_12 l customheader_2 l customheader_3 l customheader_4 l customheader_8 l destination_address l destination_port

USM Anywhere™ Deployment Guide

l device_event_category l event_description l event_name l event_severity l file_name l rep_device_address l rep_device_address_6 l rep_device_rule_id l source_address l source_port l source_process l source_username l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://support.eset.com/

Supported Plugins

USM Anywhere™ Deployment Guide 266

Supported Plugins

F5 FirePass Big-IP

When you configure F5 FirePass Big-IP to send log data to USM Anywhere, you can use the F5

FirePass Big-IP plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

VPN Concentrator

Syslog

Integrating FirePass Big-IP

Before you configure the F5 FirePass Big-IP integration, you must have the IP Address of the USM

Anywhere Sensor.

To configure FirePass Big-IP to send log data to USM Anywhere

1. Log into the F5 Web Interface.

2. Navigate to Device Management > Maintenance > Logs.

3. In the System Logs section, select Enable Remote Log Server.

4. Select Enabled Extended System Logs.

5. Enter the IP address of a USM Anywhere Sensor in the Remote Host field.

6. Select Apply System Log Changes.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l customfield_5

267 USM Anywhere™ Deployment Guide

l customfield_6 l customfield_7 l customheader_0 l customheader_1 l customheader_2 l customheader_3 l customheader_4 l customheader_5 l customheader_6 l customheader_7 l destination_address l destination_port l destination_username l event_description l event_name l event_outcome l event_severity l malware_variant l rep_device_rule_id l request_method l request_url l request_user_agent l session l source_address l source_port l source_process l source_process_id l source_username l timestamp_occured l transport_protocol

USM Anywhere™ Deployment Guide

Supported Plugins

268

Supported Plugins

Status Code l

Level, HTTP Classifier l

Geographic Location l

Number of Attempts, Operation Mode l

Route Domain l

Drop counter l

Prevention State l

Web scraping attack type

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://support.f5.com/kb/en-us/solutions/public/13000/000/sol13080.html

https://support.f5.com/kb/en-us/solutions/public/9000/100/sol9133.html

269 USM Anywhere™ Deployment Guide

Supported Plugins

FireEye MPS

When you configure FireEye MPS integration to send log data to USM Anywhere, you can use the

FireEye MPS plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

FireEye

Malware protection system syslog https://www.fireeye.com/

Integrating FireEye MPS

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure FireEye MPS to send log data to USM Anywhere

1. Log into FireEye as administrator.

2. Go to Settings > Notifications.

3. Select the rsyslog, then select Event Type.

4. Next to the Add rsyslog Server button, type AlienVault.

5. Click the Add the Rsyslog Server button.

6. In the Rsyslog Server Listing dialog box, type the IP address of the USM Anywhere Sensor in the IP Address field.

7. Make sure that the other settings display the following: a. Format — Default (CEF) b. Delivery — Per event c. Send as — Desired logging, for example, Alert.

d. Protocol — Select UDP, then select 4096 max. chunk-size.

Plugin Enablement

The FireEye MPS plugin automatically processes all messages whose syslog tag matches the value

"\\|FireEye\\|eMPS\\|"

USM Anywhere™ Deployment Guide 270

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_mac l destination_port l event_description_url l event_name l event_receipt_time l event_severity l external_id l file_hash l rep_device_address l rep_device_hostname l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l request_url l source_address l source_hostname l source_mac l source_port l suppressed l timestamp_occured l timestamp_received l transport_protocol l customfield_0 l customfield_2 l customfield_3 l customfield_4 l customfield_5

271 USM Anywhere™ Deployment Guide

Supported Plugins l customheader_0 l customheader_2 l customheader_3 l customheader_4 l customheader_5 l device_custom_number_1 l device_custom_number_1_label l device_custom_number_3 l device_custom_number_3_label

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://docs.google.com/viewer?a=v&pid=sites&srcid=aW5ub2NvbS5jby5pbHxrbm93bGVkZ2V8

Z3g6NmIxZGE4N2U2NDEwODczNA

USM Anywhere™ Deployment Guide 272

Supported Plugins

Forcepoint Triton AP-Web

When you configure Forcepoint (formerly Websense) Triton AP-Web integration to send log data to

USM Anywhere, you can use the Forcepoint Triton AP-Web plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Raytheon

Switch syslog http://www.websense.com/content/support/library/web/v80/siem/siem.pdf

Integrating Forcepoint Triton AP-Web Switch

Before you configure the integration, you must have: l

IP Address of the USM Anywhere sensor l

An instance of Forcepoint Multiplexer for each Forcepoint Policy Server in your network l

Reachability through syslog to the USM Anywhere sensor

To configure Forcepoint Triton AP-Web Switch to forward log data through syslog to

USM Anywhere

1. Log onto the web module of the TRITON Manager to activate and configure SIEM integration.

2. Perform this procedure for each Policy Server instance in your deployment.

a. Go to Settings > General2 > SIEM Integration and select Enable SIEM integration for this Policy Server.

b. Provide the IP address of the USM Anywhere Sensor.

c. Provide the port number 514.

d. Specify the Transport protocol UDP.

e. Select syslog/CEF (ArcSight) as the SIEM format to use.

This determines the syntax of the string used to pass log data to the integration.

3. To cache your changes, click OK.

4. To commit your changes, click Save and Deploy.

After the changes have been committed, Forcepoint Multiplexer connects to Filtering Service and distributes the log data to both Log Server and the USM Anywhere Sensor.

273 USM Anywhere™ Deployment Guide

Supported Plugins

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l audit_reason l bytes_in l bytes_out l content_category l destination_address l destination_hostname l destination_port l destination_translated_port l device_custom_number_1 l device_custom_number_2 l event_action l event_name l event_receipt_time l event_severity l policy l rep_device_address l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l request_content_type

USM Anywhere™ Deployment Guide 274

Supported Plugins l request_method l request_url l request_user_agent l source_address l source_port l source_username l transient

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.websense.com/content/support/library/web/v80/triton_web_help/troubleshooting.aspx

275 USM Anywhere™ Deployment Guide

Supported Plugins

ForeScout Network Access Control

When you configure ForeScout Network Access Control integration to send log data to USM

Anywhere, you can use the ForeScout Network Access Control plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Sophos

Network access control (NAC) syslog http://docplayer.net/1990594-Quick-start-guide-for-symantec-event-collectorfor-forescout-counteract.html

ForeScout NAC Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure ForeScout NAC to forward log data to the USM Anywhere Sensor

1. From the ForeScout website, download the plug-in for ForeScout CounterACT.

2. Log into your ForeScout CounterACT appliance. From the CounterACT Console toolbar, go to

Options > Plugins > Install.

3. Install the syslog plugin.

After the plugin is installed, it appears in the Plugins pane.

4. From the Plugins pane, select the syslog plugin and click Configure.

5. Complete the following parameters: a. Syslog Addess — Type the IP address of your USM Anywhere Sensor.

b. Syslog Port — 514 c. Identity — Type CounterACT.

d. Facility — Specify syslog message facility. The default value is local4.

e. Priority — Specify syslog messages priority. The default value is info.

6. Click the Events filtering tab, and select the event types that you want to send to your

USM Anywhere Sensor.

7. Click Apply.

USM Anywhere™ Deployment Guide 276

Supported Plugins

8. To start sending syslog messages, from the Options menu, click Plugins.

9. Ensure that the syslog plugin is selected.

10. Click Start.

Plugin Enablement

The ForeScout NAC plugin automatically processes all messages whose syslog tag matches one of the following values:

"NAC Policy Log”, "Block Event," or

"System statistics"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l audit_reason l customfield_0 l destination_address l destination_port l device_event_category l duration l event_description l event_name l event_violation l policy l source_address l source_mac l source_process_commandline l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.forescout.com/support/

277 USM Anywhere™ Deployment Guide

Supported Plugins

Fortinet FortiGate

When you configure Fortinet FortiGate to send log data to USM Anywhere, you can use the Fortinet

Fortigate plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Fortinet

Firewall

Syslog

Integrating Fortinet FortiGate

Before you configure the Fortinet FortiGate integration, you must have the IP Address of the USM

Anywhere Sensor. You can configure FortiGate from either the web UI or CLI.

To configure FortiGate to send log data to USM Anywhere from the web UI

1. Log into the Fortinet console, and go to Log & Report > Log Config > Log Settings.

2. Select Send Logs to Syslog and specify the USM Anywhere Sensor IP address.

3. In Event Logging, select all the event types you want to capture.

4. Click Apply.

To configure FortiGate to send log data to USM Anywhere from the CLI l

Open the Fortinet CLI Console and enter: config log syslogd setting set status enable set csv disable set facility local7 set port 514 set reliable disable set server <IP address of the USM Anywhere Sensor> set source-ip <Default: 0.0.0.0> end

Note: Fortinet allows up to three remote syslog servers:

{syslogd|syslogd2|syslogd3}

If Virtual Domains (VDOMs) are enabled, each VDOM will use the default FortiAnalyzer/Syslog server, but you can override it from the CLI, allowing you to specify a different FortiAnalyzer/Syslog server for that VDOM.

USM Anywhere™ Deployment Guide 278

Supported Plugins

Use this command within a VDOM to override the global configuration created with the config log syslogd setting command above. These settings configure the connection to the USM

Anywhere Sensor.

To override global configuration for a specific VDOM l

From the Fortinet CLI Console, enter: config log syslogd override-setting set override enable set status enable set csv disable set facility local7 set port 514 set reliable disable set server <IP address of the USM Anywhere Sensor> set source-ip <Default: 0.0.0.0> end

Plugin Enablement

The Fortigate plugin will automatically process all messages whose syslog tag matches the following regular expression:

"devname="

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l application l base_event_count l bytes_in l bytes_out l content_category l destination_address l destination_port l device_direction l device_external_id l event_category l event_description_url l event_name l event_severity

279 USM Anywhere™ Deployment Guide

l event_subcategory l http_hostname l policy l rep_device_hostname l rep_device_inbound_interface l rep_device_outbound_interface l rep_device_rule_id l rep_device_type l request_url l source_address l source_mac l source_port l source_username l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.fortinet.com/products-services/products/firewall.htm

http://docs.fortinet.com/d/fortigate-troubleshooting-2

Supported Plugins

USM Anywhere™ Deployment Guide 280

Supported Plugins

FortiManager VM

When you configure FortiManager VM integration to send log data to USM Anywhere, you can use the FortiManager VM plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Fortinet

Firewall virtual appliance syslog https://www.fortinet.com/products-services/products/firewall.html

Integrating FortiManager

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

UI Configuration

To configure FortiManager to send log data to USM Anywhere

1. Go to System Settings > Advanced > Syslog Server.

2. In the toolbar, select Create New.

3. In the New Syslog Server popup, configure the fields as follows: a. Name — Choose any name for the syslog server.

b. IP address or FQDN — IP address of the USM Anywhere Sensor.

c. Port — 514 d. Click OK.

CLI Configuration

To configure FortiManager to send log data to USM Anywhere l

Enter: config system syslog edit <Syslog_Server_name> set ip <USM_Anywhere_IP_address> end

Example config system syslog edit "Syslog-serv1"

281 USM Anywhere™ Deployment Guide

Supported Plugins set ip "11.11.11.11" next end

Configuring the Logging Level for Local Log syslogd

To configure logging level for local log syslogd l

Enter: config system locallog syslogd setting

*Syslog_Server_name must be the same name used in the previous procedure.* set syslog-name <Syslog_Server_name>

*Set the minimum severity level to log* set severity {emergency | alert | critical | error | warning | notification

| information | debug} set status {enable | disable}

*Optionally enable CSV* set csv

*Indicate facility for remote syslog* set facility <facility-name> set port 514 end

Example config system locallog syslogd setting set severity information set status enable set syslog-name "Syslog-serv1" end

Plugin Enablement

The Fortinet FortiManager plugin will automatically process all messages that contain

"devname=" as part of the raw message.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l application l base_event_count l bytes_in l bytes_out

USM Anywhere™ Deployment Guide 282

Supported Plugins l content_category l destination_address l destination_port l device_direction l device_external_id l event_category l event_description_url l event_name l event_severity l event_subcategory l http_hostname l policy l rep_device_hostname l rep_device_inbound_interface l rep_device_outbound_interface l rep_device_rule_id l rep_device_type l request_url l source_address l source_mac l source_port l source_username l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://kb.fortinet.com/kb/viewContent.do?externalId=FD34549

283 USM Anywhere™ Deployment Guide

Supported Plugins

FreeRADIUS

When you configure FreeRADIUS integration to send log data to USM Anywhere, you can use the

FreeRADIUS plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

FreeRADIUS

Network access control syslog http://wiki.freeradius.org/config/Logging

Integrating FreeRADIUS

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure FreeRADIUS to send log data over syslog to USM Anywhere

1. Log into the system hosting FreeRADIUS.

2. Edit the

/etc/freeradius/radius.conf

file to match the following: logdir = syslog log_destination = syslog log { destination = syslog syslog_facility = daemon stripped_names = no auth = yes auth_badpass = no auth_goodpass = no

}

3. Edit the

/etc/syslog.conf

file to match the following:

# .=notice logs authentication messages (L_AUTH).

# <facility_name>.=notice @<IP_address_of_USM_Anywhere_Sensor>

# .=err logs module errors for FreeRADIUS.

# <facility_name>.=err @<IP_address_of_USM_Anywhere_Sensor>

# .* logs messages to the same target.

# <facility_name>.* @<IP_address_of_USM_Anywhere_Sensor>

Where: facility_name

= any facility of your choice, for example, local1

4. To configure a log option, remove the pound sign from one of the active lines containing an

USM Anywhere™ Deployment Guide 284

Supported Plugins anpersand (

The configuration should load automatically.

5. If the configuration does not load automatically, restart the syslog daemon.

The method to restart the daemon depends on the distribution in use:

OS Distribution

RedHat

Debian/Ubuntu

FreeBSD

Daemon Restart Command service syslog restart

/etc/init.d/syslog restart

/etc/rc.d/syslogd restart

6. Add the following options to the FreeRADIUS startup script:

-l syslog

-g <facility_name>

7. Restart FreeRADIUS.

Plugin Enablement

The FreeRADIUS plugin automatically processes all messages whose syslog tag matches the value radiusd

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l audit_reason l customfield_0 l customfield_1 l customfield_2 l customfield_4 l customheader_0 l customheader_1 l customheader_2 l customheader_4

285 USM Anywhere™ Deployment Guide

l event_description l event_name l event_outcome l file_name l highlight_fields l plugin_device l plugin_rule l rep_device_hostname l source_address l source_hostname l source_mac l source_port l source_username l source_vhost l transient l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://wiki.freeradius.org/guide/Troubleshooting

Supported Plugins

USM Anywhere™ Deployment Guide 286

Supported Plugins

H3C Switch

When you configure H3C Switch integration to send log data to USM Anywhere, you can use the

H3C Switch plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

H3C

Switch syslog http://www.h3c.com.hk/Technical_SupportDocuments/Technical_Documents/

Switches/H3C_S12500_Series_Switches/Configuration/Operation_Manual/

H3C_S12500_CG-Release7128-6W710/12/201301/772703_1285_0.htm#_

Ref165188668

Integrating H3C Switch

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure H3C Switch to send log data over syslog to USM Anywhere

1. Enter system view mode: system-view

2. Verify that the information center is enabled. (It is enabled by default.) info-center enable

3. Configure an output rule for the log host: info-center source {<module-name>|default}

{console|monitor|logbuffer|logfile|loghost} {deny|level <severity>}

4. (Optional) Specify the source IP address for output logs (by default, the source IP address of output log information is the primary IP address of the matching route's egress interface): info-center loghost source <interface-type> <interface-number>

5. (Optional) Configure the time stamp format: info-center timestamp loghost {date|iso|no-year-date|none}

The default setting is date

6. Specify a log host and configure related parameters.

287 USM Anywhere™ Deployment Guide

Supported Plugins

By default, no log host or related parameters are specified.

info-center loghost [vpn-instance <vpn-instance-name>] {<IP_address_USM_

Anywhere>} [port <port_number>][facility <local-number>]

Where: port_number

= 514

Important: The value of the port-number variable must be the same as the value configured on the log host. Otherwise, the log host can't receive logs.

Plugin Enablement

For plugin enablement information, see

HP SAN Network Switch Operating System

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l customfield_1 l customheader_1 l event_description l event_name l event_outcome l event_severity l highlight_fields l plugin_device l plugin_rule l source_address l transient

USM Anywhere™ Deployment Guide 288

Supported Plugins

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.h3c.com.hk/Technical_Support___Documents/Technical_Documents/Switches/H3C_

S12500_Series_Switches/Maintenance/Troubleshooting/H3C_S12500_Troubleshooting_Guide-

R7128-6W100/

289 USM Anywhere™ Deployment Guide

Supported Plugins

HAProxy

When you configure HAProxy integration to send log data to USM Anywhere, you can use the

HAProxy plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

HAProxy

Proxy syslog http://cbonte.github.io/haproxy-dconv/1.7/configuration.html#8

Integrating HAProxy

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

The protocol for HAProxy is HTTP.

To enable this proxy protocol l

Set option httplog on the frontend to enable this format.

To configure HAProxy to send log data over syslog to USM Anywhere

1. Open the HAProxy server configuration file (

/etc/haproxy/haproxy.cfg

2. Include the following lines: global log <IP_address_of_USMA_Sensor>:514 <facility>

Where: facility must be any one of the standard syslog facilities: l kern l user l mail l daemon l auth l syslog l lpr

USM Anywhere™ Deployment Guide 290

Supported Plugins l cron2 l local0 l local1 l local2 l local3 l local4 l local5 l local6 l local7 l news l uucp l cron l auth2 l ftp l nap l audit l alert

Plugin Enablement

The HAProxy plugin automatically processes all messages whose syslog tag matches the value

"haproxy.”

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l bytes_out l event_description l event_name

291 USM Anywhere™ Deployment Guide

l log l plugin l request_method l request_url l response_code l source_address l tag l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.haproxy.com/doc/aloha/7.0/troubleshooting/index.html

Supported Plugins

USM Anywhere™ Deployment Guide 292

Supported Plugins

HP Storage Area Network (SAN) Switch

When you configure HP Storage Area Network (SAN) Switch integration to send log data to USM

Anywhere, you can use the HP SAN Switch plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Hewlett-Packard

Switch syslog

For details, see

Appendix A; Using Syslog in the vendor documentation for installation and configuration.

Integrating the HP Storage Area Network Switch

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

We provide the procedure for configuring HP Storage Area Network Switch for syslog communication with USM Anywhere, using either the

CLI

or the

HP SAN Switch web management user interface .

HP SAN Network Switch Operating System CLI

To configure the HP SAN Network Switch to send log data to USM Anywhere

1. Log into the HP SAN Network Switch.

2. Enter global configuration mode: config

3. Enter: logging <IP_Address_USM_Anywhere>

If there are no SyslogD servers configured, logging enters a SyslogD server IP address and automatically enables syslog logging to the server (USM Anywhere).

If at least one SyslogD server is already configured and syslog logging has been disabled, you can still use logging<IP_address> to add another SyslogD server.

Note: Syslog logins nevertheless remain disabled until you re-enable them with the debug destination logging command.

293 USM Anywhere™ Deployment Guide

Supported Plugins

4. To exit config mode, press CTRL+Z.

5. Save the current configuration to the startup configuration of your HP SAN Switch.

write mem

HP SAN Switch Web Management User Inteface

To configure the HP SAN Network Switch to send log data to USM Anywhere

1. Log onto the device with your username and password.

2. From the System configuration sheet, select Management.

3. From the Management panel, select the System Log link to display its configuration form, and apply the following settings.

Field

Logging

Buffer Size

Required Value

Enable

1 – 100

What It Does

Enables syslog.

(Optional) changes the number of entries the local syslog buffer can hold.

Default is 50.

Selects the Messages facility.

Selects the message level that you want it to log.

Facility

Accept Severity

Messages

Select any value.

4. To save your changes the running-config file, click Apply.

5. Click Save, and select Yes, when prompted, to save the configuration change to the startupconfig file on the flash memory of the device.

6. Display the Log Server panel by clicking the Show Log Server link, under the Apply and Reset buttons .

7. Display the System Log Server panel by clicking the Add Log Server link.

8. In the Server IP Address field, type the IP address of the USM Anywhere Sensor.

9. In the Server Udp Port field, type 514.

10. Click Add.

11. At the bottom of the dialog box, click Save.

12. When prompted, click Yes to save the configuration change to the startup-config file on the device's flash memory.

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 294

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l customfield_5 l customfield_6 l customheader_0 l customheader_1 l customheader_2 l customheader_3 l customheader_4 l customheader_5 l customheader_6 l destination_address l event_description l event_name l event_severity l rep_device_hostname l rep_device_rule_id l source_address l source_mac

295 USM Anywhere™ Deployment Guide

l source_username l timestamp_occured l user_role

Troubleshooting

For troubleshooting, refer to the vendor documentation:

Hewlett Packard Enterprise Support Center

Supported Plugins

USM Anywhere™ Deployment Guide 296

Supported Plugins

HP Switch

When you configure HP Switch integration to send log data to USM Anywhere, you can use the

HPSwitch plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Hewlett-Packard

Switch

Syslog http://www.manualslib.com/manual/73005/Hp-Procurve-2520.html?page=475

Integrating the HP Switch

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure the HP Switch to send log data to USM Anywhere

1. Log into the HP switch.

2. Enter global configuration mode: config

If successful, the CLI changes to the following prompt:

ProCurve(config)#

3. Enter: logging <syslog-ip-addr>

Where:

<syslog-ip-addr> is the IP address of the USM Anywhere Sensor.

4. Exit config mode:

CTRL+Z

5. Save the current configuration to the startup configuration for your HP ProCurve device: write mem

Plugin Enablement

For plugin enablement information, see

297 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l authentication_mode l customfield_0 l customheader_0 l destination_address l event_name l source_address l source_port

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.lindblom.it/2012/09/04/good-to-know-hp-procurve-switch-troubleshooting-commands/

USM Anywhere™ Deployment Guide 298

Supported Plugins

Huawei NGFW

When you configure Huawei Next Generation Firewall (NGFW) integration to send log data to USM

Anywhere, you can use the Huawei NGFW plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Huawei

Firewall

Syslog http://support.huawei.com/enterprise/docinforeader.action?

contentId=DOC1000047754&partNo=10042

Integrating Huawei Next Generation Firewall

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure the Huawei NGFW to send log data to USM Anywhere

1. Enter the system view: system-view

2. Enable log monitoring: firewall log stream enable

3. Export traffic monitoring logs to the USM Anywhere sensor: info-center loghost <USM-Anywhere-Sensor-IP-address> 514 facility local0

4. Exit the configuration mode: quit

Plugin Enablement

For plugin enablement information, see

299 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l affected_platform l application_protocol l audit_reason l authentication_type l base_event_count l bytes_in l bytes_out l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l destination_address l destination_address_6 l destination_port l destination_zone l device_event_category l event_action l event_description l event_name l event_security l file_name l file_type l malware_family

USM Anywhere™ Deployment Guide 300

Supported Plugins l malware_variant l packets_received l packets_sent l policy l rep_device_inbound_interface l rep_device_rule_id l source_address l source_address_6 l source_port l source_process_commandline l source_username l source_zone l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://support.huawei.com/ehedex/hdx.do?docid=DOC1000086804&tocURL=resources%2Ftro%

2Fsec_tro_cd.html&clientWidth=1424&browseTime=1479457120466

301 USM Anywhere™ Deployment Guide

Supported Plugins

IBM AIX Audit

When you configure IBM AIX Audit device integration to send log data to USM Anywhere, you can use the IBM AIX Audit plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

IBM

Operating system syslog http://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.dsm.doc/ t_dsm_guide_ibm_aix_config_audit_syslog.html

Integrating IBM AIX Audit

The IBM AIX Audit DSM automatically discovers syslog audit events forwarded from IBM AIX to

USM Anywhere, and creates a log source. If some events are not automatically discovered, you can manually configure a log source.

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure AIX Audit to send log data to USM Anywhere

1. Log into the AIX appliance.

2. Edit the audit configuration file residing at /etc/security/audit/config, as follows.

a. Edit the

Start section to disable the binmode element and enable the streammode element: binmode = off streammode = on b. Edit the

Classes section to specify which classes to audit.

c. Save the changes.

3. Open

/etc/security/audit/streamcmds

.and add the following line of code:

/usr/sbin/auditstream | /usr/sbin/auditselect -m -e "command != logger && command != auditstream && command != auditpr && command != auditselect"|auditpr -t0 -h eclrRdi -v |sed -e :a -e '$!N;s/\n / /;ta' -e

'P;D'| /usr/bin/logger -p local0.debug -r &

4. Save the change.

USM Anywhere™ Deployment Guide 302

Supported Plugins

5. Edit

/etc/syslog.conf

to specify a debug entry and the IP address of the USM Anywhere

Sensor:

*.debug @<USM-Anywhere-Sensor-IP-Address>

Important: A tab must separate *.debug from the IP address.

6. Save the change.

7. Reload the syslog configuration: refresh -s syslogd

8. Start the audit script on your IBM AIX appliance: audit start

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l customfield_1 l customheader_1 l destination_username l destination_hostname l event_description l event_name l event_outcome l file_name l file_path l source_address l source_hostname l source_port

303 USM Anywhere™ Deployment Guide

l source_userid l source_username l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: l

See the Redbook on Auditing and Accounting on AIX at http://www.redbooks.ibm.com.

See the Audit Subsystem in AIX at http://www-01.ibm.com/support/docview.wss?uid=isg3T1000212

Supported Plugins

USM Anywhere™ Deployment Guide 304

Supported Plugins

IBM Tivoli Access Manager Web SEAL

When you configure IBM Tivoli Access Manager Web SEAL integration to send log data to USM

Anywhere, you can use the IBM Tivoli Access Manager Web SEAL plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

IBM

Proxy

Syslog https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.dsm.doc/ t_DSM_guide_IBM_TivoliAccess_cfg.html#t_dsm_guide_ibm_tivoliaccess_ cfg and https://www.ibm.com/blogs/sweeden/introduction-to-qradar-logmanagement-for-webseal-administrators/

Integrating the Tivoli Access Manager WebSEAL Device

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Tivoli to send log data to USM Anywhere

1. Log into Tivoli Access Manager's IBM Security Web Gateway.

2. From the primary navigation menu, go to Secure Reverse Proxy Settings > Manage >

Reverse Proxy.

3. From the Instance column of the Reverse Proxy pane, select an instance.

4. Click the Manage list and select Configuration > Advanced.

The text of the WebSEAL configuration file appears.

5. Locate the Authorization API Logging configuration, and configure event log forwarding to the

USM Anywhere Sensor by copying and pasting the following command to a new line: logcfg = audit.azn:rsyslog server=<USM Anywhere_IP_address>,port=514,log_ id=<log_name>

6. Edit the remote syslog configuration, for example: logcfg = audit.azn:rsyslog server=<USM Anywhere_IP_address>,port=514,log_ id=<log_name> logcfg = audit.authn:rsyslog server=<USM Anywhere_IP_ address>,port=514,log_id=<log_name> logcfg = http:rsyslog server=<USM Anywhere_IP_address>,port=514,log_id=<log_name>

305 USM Anywhere™ Deployment Guide

Supported Plugins

Where:

<Log_name> is the name assigned to the log that you want to forward to USM Anywhere, for example, log_id=WebSEAL-log

7. Configure the log format, for example: request-log-format = %h %l %u %t "%r" %s %b "%{user-agent}i"

Where:

%h =

Client host

%l =

Client logname (RFC 1314) (default -)

%u =

Remote user

%t =

Time in Common Log Format

%r =

First line of the request

%s =

Response status

%b =

Bytes in the response, excluding HTTP headers in CLF format: '-' instead of 0 when no bytes are returned.

8. Click Submit.

The Deploy button appears in the navigation menu.

9. Click Deploy.

10. To continue, restart the reverse proxy instance: a. From the Instance column, select your instance configuration.

b. From the Manage list, select Control > Restart.

A status message appears after the restart completes.

For more information on configuring a syslog destination, see your IBM Tivoli Access Manager for ebusiness vendor documentation.

Plugin Enablement

For plugin enablement information, see

Defining a New Action Set

USM Anywhere™ Deployment Guide 306

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol= l bytes_out= l event_description= l event_name= l plugin_device= l plugin_device_type= l request_http_version= l request_method= l request_url= l request_user_agent= l response_code= l source_address= l source_hostname= l source_username= l time_zone=

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.ibm.com/support/knowledgecenter/en/SSPREK_8.0.0.2/com.ibm.amweb.doc_

8.0.0.2/landing/trouble_landing.html

307 USM Anywhere™ Deployment Guide

Supported Plugins

Imperva SecureSphere Web Gateway

When you configure the Imperva Securesphere Web Gateway integration to send log data to USM

Anywhere, you can use the Imperva Securesphere Web Gateway plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Imperva

WAF syslog https://www.imperva.com/Products/WebApplicationFirewall-WAF

Integrating Securesphere

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

The integration of Securesphere consists of the following tasks: l

Configuring a Custom Policy Security Event

Configuring a Firewall Security Event

Configuring a System Event

Defining a New Action Set

To configure SecureSphere to send log data to USM Anywhere

1. Define a new Action Set and configure the parameters as follows: a. Name — The action set name, for example, security_syslog.

b. Syslog Host — The IP address or hostname of your USM Anywhere Sensor.

c. Syslog Log Level — Syslog log level.

d. Facility — Any facility.

2. On the Policies page under Policy Rules, select the appropriate items in the Followed Action column.

Note: Use the action set defined for security events in step 1.

This is the action that you want to send to syslog when a violation occurs. When a security violation occurs, an alert is generated and a syslog message is sent.

USM Anywhere™ Deployment Guide 308

Supported Plugins

Configuring a Custom Policy Security Event

To configure SecureSphere to send syslog messages when a custom policy event occurs

1. Define a new Action Set and configure the parameters as follows: a. Name — The action set name, for example, security_syslog

b. Syslog Host — The IP address or hostname of your USM Anywhere Sensor.

c. Syslog Log Level — Syslog log level.

d. Facility — Any facility.

2. On the Policies page under Policy Rules, select the appropriate items in the Followed Action column.

Note: Use the action set defined for security events in step 1.

These are the custom security policies that you want to send to syslog when a violation occurs.

Configuring a Firewall Security Event

To configure SecureSphere to send syslog messages when a firewall security event occurs

1. Define a new Action Set and configure the parameters as follows: a. Name — The action set name, for example, firewall_security_syslog

b. Syslog Host — The IP address or hostname of your USM Anywhere Sensor.

c. Syslog Log Level — Syslog log level.

d. Facility — Any facility.

2. On the Policies page under Policy Rules, select the firewall policies you want in the Followed

Action column.

Note: Use the action set defined for security events in step 1.

These are the firewall security policies that you want to send to syslog when a violation occurs.

Configuring a System Event

To configure SecureSphere to send syslog messages when system event occurs

1. Define a new Action Set and configure the parameters as follows: a. Name — The action set name, for example, system_syslog

b. Syslog Host — The IP address or hostname of your USM Anywhere Sensor.

c. Syslog Log Level — Syslog log level.

309 USM Anywhere™ Deployment Guide

Supported Plugins d. Facility — Any facility.

2. On the Policies page under Policy Rules, create the system event policy you want in the

Followed Action column.

Note: Use the action set defined for security events in step 1.

These are the system event policies that you want to send to syslog when a violation occurs.

Plugin Enablement

For plugin enablement information, see

Configuring a syslog Host to Use Netscreen NSM

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_2 l customfield_3 l customfield_4 l customheader_0 l customheader_1 l customheader_2 l customheader_3 l customheader_4 l destination_address l destination_hostname l destination_port l device_direction l event_action l event_category l event_description l event_name l event_severity l http_hostname l policy l request_method l request_url

USM Anywhere™ Deployment Guide 310

Supported Plugins l response_code l security_group_name l session l source_address l source_hostname l source_port l source_username l timestamp_occured l timestamp_received l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://expertsecure.wordpress.com/2012/06/20/guide-to-imperva-securesphere-networkinstallation/

Imperva SecureSphere CEF

When you configure Imperva SecureSphere CEF integration to send log data to USM Anywhere, you can use the Imperva SecureSphere CEF plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Imperva

Application Firewall syslog https://www.imperva.com/docs/SB_Imperva_SecureSphere_CEF_guide.pdf

Configuring Imperva SecureSphere

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

SecureSphere offers four different events, each requiring slightly different configuration: l

Security Event l

Custom Security Event l

Firewall Security Event l

System Event

311 USM Anywhere™ Deployment Guide

Supported Plugins

Note: See the Imperva SecureSphere Configuration Guide for further information.

To set SecureSphere to send syslog messages based on the CEF standard when a new event occurs

1. Define a new Action Set and configure the parameters as follows: l

Name: The action set name, for example, security_syslog.

Syslog Host: The IP or host name of the Syslog server.

Syslog Log Level: The Syslog log level.

Message: The CEF message for a security event (alert).

Facility: The facility name that you want.

2. Edit the security policies and modify the Followed Actions for those that you want to send to Sys-

USM Anywhere™ Deployment Guide 312

Supported Plugins log when a violation occurs. Use the action set defined for security events in step 1.

313

When a security violation occurs, SecureSphere generates an alert and sends a Syslog message.

Plugin Enablement

The Imperva SecureSphere CEF plugin will automatically process all messages whose raw message contains |Imperva Inc.|SecureSphere|.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_port l destination_username

USM Anywhere™ Deployment Guide

l device_event_category l event_action l event_description l event_name l event_receipt_time l event_severity l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l source_address l source_port l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.imperva.com/Services/TechnicalSupport

Supported Plugins

USM Anywhere™ Deployment Guide 314

Supported Plugins

Incapsula Web Application Firewall

When you configure Incapsula Web Application Firewall integration to send log data to USM

Anywhere, you can use the Incapsula Web Application Firewall plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Imperva

Web Application Firewall syslog https://docs.incapsula.com/Content/read-more/incapsula-log-configurationfile.htm

315 USM Anywhere™ Deployment Guide

Supported Plugins

Integrating Incapsula

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Incapsula to send log data to USM Anywhere l

Edit the settings.config

file by providing values for the parameters that follow.

Note: Consult the vendor documentation for the location of the settings.config

file.

settings.config

parameters requiring edit

Parameter

ApiID

ApiKey

PROCESS_DIR:

BASEURL

USEPROXY

PROXYSERVER

SAVE LOCALLY

SYSLOG_ENABLE

SYSLOG_ADDRESS

SYSLOG_PORT

USE_CUSTOM_CA_FILE

CUSTOM_CA_FILE

Value Description

Your API ID

Your API key

Specifies the directory into which Incapsula automatically saves the logs after unzipping and decrypting them.

Specifies the URL of your logs repository in the Incapsula cloud. This

URL is displayed in the Incapsula Administration Console Settings window as the Log Server URL field.

Specify YES to use a proxy to download the files.

If you choose to use a proxy, supply the proxy URL in the following format: https://1.1.1.1:8080

A Yes/No value that instructs Incapsula whether to maintain the log files after they are processed. When set to No, the files are deleted.

A Yes/No value that instructs Incapsula about whether to send the files by syslog.

If syslog is enabled, provide the USM Anywhere IP address to which to send the logs.

If syslog is enabled, provide the syslog port.

Default "no" in case the service's certificate is not in the default bundle

Path for the custom certificate file

USM Anywhere™ Deployment Guide 316

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l account_name l application l application_protocol l bytes_in l customfield_0 l customfield_1 l customfield_2 l customfield_4 l customfield_10 l customheader_0 l customheader_1 l customheader_2 l customheader_4 l customheader_10 l device_external_id l event_action l event_description l event_name l event_severity l file_permission l file_type l highlight_fields l http_referer l incident_id l ip_addresses l plugin_device l rep_device_rule_id l rep_device_type l rep_device_vendor

317 USM Anywhere™ Deployment Guide

Supported Plugins l rep_device_version l request_method l request_url l request_user_agent l response_code l session l source_address l source_service_name l source_userid l time_start l transient

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://incapsula.zendesk.com/hc/en-us/articles/209074918-Common-Incapsula-Errors-and-Their-

Solutions

USM Anywhere™ Deployment Guide 318

Supported Plugins

Juniper EX Series

When you configure Juniper EX Series integration to send log data to USM Anywhere, you can use the Juniper EX Series plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

Juniper Networks

Switch syslog https://www.juniper.net/techpubs/en_US/junos14.1/topics/ reference/configuration-statement/host-edit-system.html

Integrating Juniper EX Series

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Juniper EX Series to send log data over syslog to USM Anywhere

1. Log into the Juniper EX device CLI console.

2. Include the host statement at the [edit system syslog] hierarchy level: host (<hostname>) {

<facility> <severity>; explicit-priority; facility-override <facility>; log-prefix <string>; match "<regular-expression>"; port 514; source-address <source-address>;

}

319 USM Anywhere™ Deployment Guide

Supported Plugins

Where: l hostname = IP address of the USM Anywhere Sensor l

In each host statement, include the facility-override statement to assign an alternative facility.

Facility any authorization change-log conflict-log daemon dfc firewall ftp interactivecommands kernel pfe

Type of Event or Error

All (messages from all facilities)

Authentication and authorization attempts.

Changes to the Junos OS configuration.

Specified configuration is invalid on the router type.

Actions performed or errors encountered by system processes.

Events related to dynamic flow capture.

Packet filtering actions performed by a firewall filter.

Actions performed or errors encountered by the FTP process.

Commands issued at the Junos OS command-line interface (CLI) prompt or by a client application such as a Junos XML protocol or NETCONF XML client.

Actions performed or errors encountered by the Junos OS kernel.

Actions performed or errors encountered by the Packet Forwarding

Engine.

Actions performed or errors encountered by user-space processes.

user l severity = the severity of your choice.

Severity Level any none emergency alert critical

Description

Includes all severity levels.

Disables logging of the associated facility to a destination.

System panic or other condition that causes the router to stop functioning.

Conditions that require immediate correction, such as a corrupted system database.

Critical conditions, such as hard errors.

USM Anywhere™ Deployment Guide 320

Supported Plugins

Severity Level error warning notice info

Description

Error conditions that generally have less serious consequences than errors at the emergency, alert, and critical levels.

Conditions that warrant monitoring.

Conditions that are not errors but might warrant special handling.

Events or non-error conditions of interest.

(Optional) Explicit-priority: Record the priority (facility and severity level) in each standardformat system log message directed to a file or remote destination.

(Optional) string = the log prefix of your choice. See the following examples.

(Optional) regular-expression = the regular expression of your choice.

(Optional) source-address = IP address of the router that is reported in the messages as their source.

Plugin Enablement

The Juniper EX plugin automatically processes all messages whose syslog tag matches the value dot1xd

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l device_inbound_interface l event_category l event_description l event_name l highlight_fields l plugin_device l plugin_rule l source_mac l source_username l transient l virtual_source_name

321 USM Anywhere™ Deployment Guide

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://kb.juniper.net/InfoCenter/index?page=content&id=KB9936&actp=search

Supported Plugins

USM Anywhere™ Deployment Guide 322

Supported Plugins

Juniper Netscreen NSM

When you configure Juniper Netscreen NSM integration to send log data to USM Anywhere, you can use the Juniper Netscreen NSM plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Juniper

Network and security manager syslog https://www.juniper.net/techpubs/en_US/nsm2012.2/topics/task/ operational/security-service-syslog-configuring-nsm.html

Integrating Netscreen NSM

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

Integrating Netscreen NSM consists of the following tasks: l

Using WebTrends Reporting to Enable syslog Reporting

323 USM Anywhere™ Deployment Guide

Supported Plugins

Configuring a syslog Host to Use Netscreen NSM

To configure a syslog host to use Netscreen NSM

1. On the Syslog configuration screen (shown), click the Add icon to launch the Config dialog box for host configuration.

2. Specify the hostname and port (must be 514) to which the security device sends syslog messages.

3. For each syslog host, specify the following: l

Any traffic log entries, event log entries, or both traffic and event log entries, if applicable.

Security facility responsible for classifying and sending messages to the syslog host for security-related actions.

Standard facility responsible for classifying and sending messages for events unrelated to

USM Anywhere™ Deployment Guide 324

Supported Plugins security.

Transport protocol used for sending syslog messages.

4. Click OK.

Note: USM Anywhere only supports UDP at this time.

Using WebTrends Reporting to Enable syslog Reporting

The WebTrends reporting function lets you configure a device to send syslog reports to a

WebTrends syslog host.

The WebTrends Firewall Suite allows customization of syslog reports to display the information you specify in a graphical format, such as that shown in the following illustration.

325

As of ScreenOS 6.3, the event log, traffic log, and IDP log formats follow the WebTrends

Enhanced Format (WELF) log regulation.

USM Anywhere™ Deployment Guide

Supported Plugins

If backup for the logs is enabled, you can send logs to a maximum of four WebTrends servers.

Although WebTrends supports both TCP and UDP transport protocols, USM Anywhere only supports UDP at this time.

You can manually reset IP connections, if desired.

To configure the security device to send syslog reports to a WebTrends syslog host

1. Enable WebTrends reporting.

2. Specify the name of the WebTrends host and 514 as the port on through which to send the syslog messages.

Note: If you are sending reports through a VPN tunnel, click Use Trust Zone Interface.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports. In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l bytes_in l bytes_out l destination_address l destination_nat_address l destination_nat_port l destination_port l destination_username l destination_zone l device_inbound_interface l device_outbound_interface l event_category l event_description l event_name l event_severity l event_subcategory l packet_data

USM Anywhere™ Deployment Guide 326

Supported Plugins l packets_received l packets_sent l policy l rep_device_address l rep_device_hostname l rule_id l source_address l source_nat_address l source_nat_port l source_port l source_zone l timestamp_occured l timestamp_received l total_packets l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://kb.juniper.net/InfoCenter/index?page=content&id=KB28986&actp=search

327 USM Anywhere™ Deployment Guide

Supported Plugins

Juniper SA SSL VPN

When you configure Juniper Secure Access VPN integration to send log data to USM Anywhere, you can use the Juniper Secure Access VPN plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Juniper Networks

VPN syslog

Use the vendor search page to access the Juniper SA-SSLVN 7.0

Administration Guide in PDF format.

Integrating Juniper SA SSL VPN

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Juniper SA SSL VPN to send log data to USM Anywhere

1. Log into the Juniper administration console as system administrator and go to System > Log

Monitoring.

2. Select one of the following, then select Settings: l

Events Log l

User Access Log l

Admin Access Log l

Sensors Log

3. In the Maximum Log Size field, specify the maximum file size for the local log file (500 MB possible).

The system log displays data up to the amount specified.

Important: Maximum Log Size is an internal setting that most closely corresponds with the size of standard-format logs. If you select a more verbose format, such as WELF, your log files may exceed the limit that you specify here.

4. Under Select Events to Log, indicate the types of events that you want to capture in the local log file:

USM Anywhere™ Deployment Guide 328

Supported Plugins l

SAM/Java l

User Settings l

Secure Terminal l

Network Connect l

File Requests

Note: If you deselect the Statistics checkbox in the Events Log tab, the IVE does not write statistics to the log file, but continues to display them in the System >

Log/Monitoring > Statistics tab.

5. Under Syslog Servers, type information about the USM Anywhere Sensor to which you want to send your log files: a. IP address of the USM Anywhere Sensor.

b. Indicate a facility for the USM Anywhere Sensor.

The IVE provides eight facilities (LOCAL0-LOCAL7) that you can map to facilities on the

USM Anywhere Sensor.

c. (Central Manager only) Select the filter that you want to apply to the log file.

d. Click Add.

6. (Optional) Repeat for multiple sensors, if required, using different filters, if desirable.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l audit_reason l customfield_0 l customfield_1 l customfield_2 l destination_address l destination_hostname l destination_port l destination_username

329 USM Anywhere™ Deployment Guide

l error_code l event_name l file_name l file_type l rep_device_address l rep_device_hostname l request_url l security_group_name l source_address l source_mac l source_username l timestamp_occured l timestamp_received l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://kb.juniper.net/InfoCenter/index?page=content&id=KB10093&actp=search

Supported Plugins

USM Anywhere™ Deployment Guide 330

Supported Plugins

Juniper SRX

When you configure Juniper SRX to send log data to USM Anywhere, you can use the Juniper SRX plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Juniper

Unified Threat Manager

Syslog

Integrating Juniper SRX

Before you configure the Juniper SRX integration, you must have the IP Address of the USM

Anywhere Sensor. Follow the procedure for configuring Juniper SRX for syslog communication with

USM Anywhere using either Juniper SRX CLI or Juniper SRX JWeb.

SRX Console CLI

To configure syslog through the SRX console

1. Launch SRX and open the CLI Console.

2. Set the USM Anywhere Sensor as the syslog host: set system syslog host <IP address of the USM Anywhere Sensor> any any

SRX JWeb

To configure syslog through SRX JWeb

1. Log into the Juniper SRX device.

2. Click Configure > CLI Tools > Point and Click CLI.

3. Expand System and click Syslog.

4. In the Host section of the Syslog page (bottom-right), click Add New Entry.

5. Enter the IP address of the USM Anywhere Sensor.

6. Click Apply.

Plugin Enablement

For plugin enablement information, see

331 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l application_protocol l bytes_in l bytes_out l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l customheader_0 l customheader_1 l customheader_2 l customheader_3 l customheader_4 l destination_address l destination_hostname l destination_port l device_direction

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://kb.juniper.net/InfoCenter/index?page=content&id=KB16502&actp=search http://www.juniper.net/techpubs/en_US/junos12.1x46/information-products/pathwaypages/security/security-monitoring-and-troubleshooting-index.html

USM Anywhere™ Deployment Guide 332

Supported Plugins

Juniper SSG

When you configure Juniper SSG integration to send log data to USM Anywhere, you can use the

Juniper SSG plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Juniper

Firewall syslog https://kb.juniper.net/InfoCenter/index?page=content&id=KB4759&actp=search

Integrating Juniper SSG

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Juniper SSG to send log data to USM Anywhere

1. Open the web UI.

For more information, refer to KB4317 - [ScreenOS] Accessing your Juniper firewall device using the WebUI .

2. From the ScreenOS console menu, go to Configuration > Report Settings> Syslog.

3. From the Syslog page, select Enable Syslog Messages.

4. Expand Source interface and select the interface from which syslog packets are sent.

5. Enter information about the USM Anywhere Sensor.

Note: Syslog messages can be sent to up to four designated syslog servers.

Enable —Select this option to enable the syslog server.

IP/ Hostname —IP address or hostname of yourUSM Anywhere Sensor.

Port —Keep the default (UDP 514).

Security Facility —Security facility that classifies and sends security-specific events to the syslog host. Security event examples: l

Authentication violations l

Policy violations l

Replays of security attributes

333 USM Anywhere™ Deployment Guide

Supported Plugins l

Encryption failures l

Decryption failures l

Key-generation failures l

Cryptographic and non-cryptographic module self-test failures l

Internet Key Exchange (IKE) Phase 1 authentication failures l

IKE Phase 2 authentication failures l

Facility —Standard facility responsible for classifying and sending all other messages for events unrelated to security.

Event Log —Select this option to send event log entries to the syslog host.

Traffic Log —Select this option to send traffic log entries to the syslog host.

TCP —Keep the default setting (UDP).USM Anywhere only supports UDP transport protocol at present.

6. Click Apply.

CLI Version of Integration

To configure Juniper SSG to send log data to USM Anywhere set syslog enable set syslog config <xxx.xxx.x.x> set syslog config <xxx.xxx.x.x> facilities local0 local0 set syslog config <xxx.xxx.x.x> log traffic set syslog src-interface <<interface_name>>

Log Event Levels

When a level is chosen, that level of events, and above, are logged.

Local0 == Debug level. Debug level and above (ALL) events are logged.

Local3 == Warning level (Warning / Error / Critical / Alert / Emergency level events are logged l

Local4 == Error level (Error / Critical / Alert / Emergency level events are logged) l

Local5 == Critical level (Critical / Alert / Emergency level events are logged) l

Local6 == Alert level (Alert and Emergency level events are logged).

Local7 == Emergency level (Only Emergency level events are logged).

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 334

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_type l customfield_0 l customfield_1 l destination_address l destination_port l destination_username l event_action l event_category l event_name l event_severity l plugin_device_version l rep_device_hostname l rep_device_inbound_interface l rep_device_rule_id l source_address l source_mac l source_port l source_username l timestamp_occured l timestamp_received l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.juniper.net/techpubs/en_US/release-independent/screenos/informationproducts/pathway-pages/ssg-series/product/index.html

335 USM Anywhere™ Deployment Guide

Supported Plugins

Kaspersky Security Center

When you configure Kaspersky integration to send log data to USM Anywhere, you can use the

Kaspersky plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Kaspersky

Management platform syslog

For vendor documentation, visit the vendor's website and look for the

Kaspersky Lab v10 Administrator's Guide

Intigrating Kaspersky Security Center

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Kaspersky Security Center to forward log data over syslog to USM Anywhere

1. Log into the Kaspersky Security Center.

2. In the Console Tree, expand the Reports and notifications folder.

3. Right-click Event and select Properties.

4. On the Events Properties page, select Automatically export events to SIEM system database in the Exporting events section.

5. In the SIEM system list, select the system to which you want to export events.

By default, ArcSight system is selected.

6. Type the IP address of the USM Anywhere Sensor and port 514 in thecorresponding fields.

7. (Optional) To export historical data to USM Anywhere, click Export archive.

By default, Kaspersky otherwise forwards events starting from the current date.

8. Click OK.

Plugin Enablement

The Kaspersky Security Center plugin automatically processes all messages whose syslog tag matches one of the following values: l klactprx l kladminserver l kldumper

USM Anywhere™ Deployment Guide 336

Supported Plugins l klnagent l klsecuritycenter l klwebsrv

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l audit_reason l customfield_0 l customfield_1 l customheader_0 l customheader_1 l destination_hostname l device_nt_domain l email_sender l email_subject l event_description l event_name l event_outcome l file_path l highlight_fields l malware_variant l plugin_device l plugin_rule l request_url l security_group_name l source_hostname l source_process

337 USM Anywhere™ Deployment Guide

l source_process_id l source_user_privileges l source_username l timestamp_occured l transient

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://support.kaspersky.com/ksc10/error

Supported Plugins

USM Anywhere™ Deployment Guide 338

Supported Plugins

Malwarebytes Breach Remediation

When you configure Malwarebytes Breach Remediation integration to send log data to USM

Anywhere, you can use the Malwarebytes Breach Remediation plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Malwarebytes

Antivirus syslog

MBBRGuide.pdf

at https://www.malwarebytes.com

Malwarebytes Breach Remediation Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Breach Remediation to forward log data to USM Anywhere

1. After launching Breach Remediation, edit the following parameters: mbbr settings

[log.enabled:true|false]

[log.server:<host>]

[log.port:<port>] l log.enabled:

true

l log.server:

IP address of the USM Anywhere Sensor l log.port:

514

More options: o log.events:<event_name>:on|off:

Specifies whether logging is enabled/disabled for each following potential event that may be logged by Malwarebytes Breach Remediation.

ScanStartEvent n

DetectionEvent n

RestoreEvent n

CustomDbUpdateEvent n

ScanEndEvent n

RemovalEvent n

RestoreStartEvent

339 USM Anywhere™ Deployment Guide

Supported Plugins n

DbUpdateEvent n

RemoveLastScanEvent n

RestoreEndEvent o log.test:

Tries to make contact with the syslog server using the provided host and port specifications. Results of the connection attempt display on the screen.

Note: This command does not generate an event log entry. No additional parameters are required.

Plugin Enablement

The Malwarebytes Breach Remediation plugin automatically processes all messages whose syslog tag matches the value

"Malwarebytes|Malwarebytes Breach Remediation|"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l customfield_5 l customheader_0 l customheader_1 l customheader_2 l customheader_3 l customheader_4 l customheader_5 l destination_mac l device_custom_number_1 l device_custom_number_1_label

USM Anywhere™ Deployment Guide 340

Supported Plugins l device_event_category l event_action l event_description l event_name l event_outcome l event_receipt_time l event_severity l file_hash l file_path l highlight_fields l malware_family l plugin_device l rep_device_hostname l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l session l source_process_commandline l source_username l time_end l time_start

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://support.malwarebytes.com/

341 USM Anywhere™ Deployment Guide

Supported Plugins

Malwarebytes Endpoint Security

When you configure Malwarebytes Endpoint Security integration to send log data to USM

Anywhere, you can use the Malwarebytes Endpoint Security plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Malwarebytes Endpoint Security

Endpoint security syslog https://support.malwarebytes.com/customer/en/portal/articles/2132853-howdo-i-configure-the-management-console-to-connect-to-a-syslog-server-?b_

id=6520

Integrating Malwarebytes Endpoint Security

Before you configure the integration, you must have the IP Address of the USM Anywhere sensor and Malwarebytes Management Console 1.6.0 or above.

To configure Malwarebytes Endpoint Security to send log data over syslog to USM Anywhere

1. Log onto the Management Console.

2. Click the Admin pane.

3. Click the Syslog Server tab.

4. Click Change...

USM Anywhere™ Deployment Guide 342

Supported Plugins

5. Check Enable Syslog.

6. Enter the following information into the respective fields:

Field

Syslog Server

Value Explanation

IP address of the USM Anywhere sensor

Port

Protocol

Facility

514

UDP

Facility in which you'd like Malwarebytes logs to appear

Severity Severity threshold of events you want Malwarebytes logs to capture in syslog

Payload Format JSON

7. Click OK.

Plugin Enablement

The Malwarebytes Endpoint Security plugin automatically processes all messages that have

"Malwarebytes-Endpoint-Security" in their syslog tag.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l destination_address l device_direction l event_action l event_description l event_name l event_outcome l event_severity l external_id l file_name l file_path

343 USM Anywhere™ Deployment Guide

l log_json l malware_variant l plugin_device l rep_device_model l source_address l source_hostname l source_mac l source_ntdomain l source_port l source_process l source_username

Supported Plugins

USM Anywhere™ Deployment Guide 344

Supported Plugins

McAfee Database Security

When you configure McAfee Database Security integration to send log data to USM Anywhere, you can use the McAfee Database Security plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

McAfee

Database syslog

For details, see the vendor documentation in PDF format

McAfee Database

Security ArcSight Integration via Syslog .

McAfee Database Security Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure McAfee Database Security to send log data to USM Anywhere

1. Log into the Database Security console.

2. Select System > Interfaces > Syslog.

3. Select the Use syslog checkbox.

4. Configure the syslog host/port (USM Anywhere Sensor IP address and port 514).

5. Select the transport protocol UDP.

6. Set the syslog format to CEF.

7. Click Save.

Plugin Enablement

For plugin enablement information, see

Collecting Logs from a Windows System . They enable a Windows DNS

345 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customfield_1 l customfield_2 l customheader_0 l customheader_1 l customheader_2 l destination_address l destination_process l destination_username l event_action l event_name l event_receipt_time l event_severity l external_id l highlight_fields l plugin_device l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l source_address l source_hostname

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://kc.mcafee.com/corporate/index?page=content&id=KB81849

USM Anywhere™ Deployment Guide 346

Supported Plugins

McAfee Web Gateway

When you configure McAfee Web Gateway to send log data to USM Anywhere, you can use the

McAfee Web Gateway plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

McAfee

Gateway

Syslog

Integrating McAfee Web Gateway

Before you configure the McAfee Web Gateway integration, you must have the IP Address of the

USM Anywhere Sensor.

To avoid potentially having your changes overwritten, complete this task, using only the McAfee

Web Gateway web interface File Editor on a per appliance basis. Do not edit

/etc/rsyslog.conf

directly.

To configure McAfee Web Gateway to send log data to USM Anywhere

1. In File Editor, look for rsyslog.conf

2. Look for a line similar to the following:

*.info;mail.none;authpriv.none;cron.none /var/log/messages

3. Make sure that the syslog daemon does not write any messages coming from the daemon facility (McAfee Web Gateway) with the level "info" to the

/var/log/messages file by replacing it with the following line:

*.info;daemon.!=info;mail.none;authpriv.none;cron.none -/var/log/messages

Important: This updated line ensures that the syslog daemon does not write any messages from the daemon facility (the McAfee Web Gateway) with info level, to the

/var/log/messages file. Capturing and writing "info" level messages generates a high volume of messages, which could overflow the

/var partition.

4. Send the data to a syslog server using UDP by adding a line like the one below to the end of the file: daemon.info @<USM-Anywhere-Sensor-IP-Address>:514

347 USM Anywhere™ Deployment Guide

5. Enable CEF format, as shown in the following figures.

Supported Plugins

USM Anywhere™ Deployment Guide 348

Supported Plugins

Plugin Enablement

The McAfee Web Gateway plugin will automatically process all messages whose syslog tag matches the following regular expression:

McAfee Web Gateway

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l bytes_out l customfield_0 l customfield_2 l customfield_3 l customfield_4 l customfield_5 l customheader_0 l customheader_2 l customheader_3 l customheader_4 l customheader_5 l content_category l destination_address l destination_hostname l device_custom_number_1 l device_custom_number_1_label l device_event_category l event_name l event_receipt_time l event_severity

349 USM Anywhere™ Deployment Guide

l malware_variant l policy l protocol_version l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l reputation_score l request_method l request_url l request_user l source_address l source_username

Additional Resources and Troubleshooting https://community.mcafee.com/docs/DOC-5206

For troubleshooting, refer to the vendor documentation: https://kc.mcafee.com/corporate/index?page=content&id=KB73869

Supported Plugins

USM Anywhere™ Deployment Guide 350

Supported Plugins

Microsoft Windows DNS Server

When you configure Microsoft Windows DNS Server integration to send log data to USM

Anywhere, you can use the Microsoft Windows DNS Server plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Microsoft

Server

Syslog https://www.microsoft.com/en-US/download/details.aspx?id=53314

Integrating Microsoft Windows DNS Server

These tasks are subtasks of

server to send log data to USM Anywhere. Before you configure the integration, you must have the

IP Address of the USM Anywhere Sensor.

Here are some best practices: l

When you set the debug logging options, select log packets for debugging. You may want to adjust these selections for performance.

The most useful debug logging output comes from selecting at least three options: o

One option under Packet direction o

One option under Transport protocol o

At least one more option in another category

In addition to selecting events for the DNS debug log file, you can specify the file name, location, and a maximum file size for the file. However, in most cases, the default selections are adequate.

Consider limiting the traffic captured by logging between your server and the DNS server.

a. Select Filter packets by IP address.

b. Add the appropriate IP addresses by clicking Filter.

Enabling Windows DNS Debug Logging

To enable Windows DNS debug logging

1. From the Windows Start Menu, select All Programs > Administrative Tools.

2. Select DNS.

3. From the console tree, right-click the applicable DNS server; then click Properties.

351 USM Anywhere™ Deployment Guide

Supported Plugins

4. Click the Debug Logging tab.

5. Select log packets for debugging, then select the events that you want the DNS server to record for debug logging.

6. Add the following lines to the NXLog configuration file:

Module im_file

File "C:\\Windows\\Sysnative\\dns\\dns.log"

SavePos TRUE

InputType LineBased

Exec if $raw_event =~ /^#/ drop(); \ else \

{ \

$Message = $raw_event: \

$SourceName = "DNS"; \

$raw_event = to_json(); \

}

</Input>

Setting Up Windows Event Collection Forwarding

If you plan to implement Windows Event Collection and Forwarding (WEF) to collect Windows logs, add the following line in the collector's NXLog configuration file:

Nxlog conf

Plugin Enablement

For plugin enablement information, see

Creating a New CloudWatch Collection

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 - Header l customfield_1 - Return Code l customfield_2 - Return Code Description l customfield_3 - Resource Type ID l customfield_4 - Resource Type Description l customheader_0

USM Anywhere™ Deployment Guide 352

Supported Plugins l customheader_1 l customheader_2 l customheader_3 l customheader_4 l destination_address l dns_rrname l dns_rrtype l dns_type l event_name l plugin_device l source_address l source_process l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://technet.microsoft.com/en-us/library/cc731991(v=ws.11).aspx

353 USM Anywhere™ Deployment Guide

Supported Plugins

Microsoft IIS Server on AWS

When you configure Microsoft IIS (Internet Information Services) Server on AWS integration to send log data to the USM Anywhere AWS sensor, you can use the plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Microsoft

Web server

CloudWatch https://www.iis.net/learn

Integrating Microsoft IIS Server

Two versions of this plugin are available, depending on the version of the IIS: l

Microsoft IIS (pre 8.0) Plugin l

Microsoft IIS 8.0+ Plugin

To configure Microsoft IIS on AWS to send log data through CloudWatch

1. Follow the instructions on AWS website to install the CloudWatch Agent on your host.

2. Configure the agent to send IIS logs to the group

IIS-Logs

Important: We expect all the log streams in a group to be the same content type (use the same plugin), in this case, Microsoft IIS 8.0+ Plugin or Microsoft IIS (pre-8.0) Plugin.

3. In the USM Anywhere web UI, go to Settings > Scheduler and enable CloudWatch - IIS Logs.

This enables USM Anywhere to find the logs automatically without your needing to create a scheduled job.

Important: Only the Microsoft II 8.0+ Plugin allows USM Anywhere to find the logs automatically. For this reason, if you use the Microsoft II (pre-8.0) Plugin, you must schedule a job manually. For instructions, see

USM Anywhere™ Deployment Guide 354

Supported Plugins

Job, on page 89

355

4. Wait for events to show up in the web interface.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_port l event_description l event_name l highlight_fields l plugin_device l plugin_device_version l request_method l request_url l request_user_agent l response_code l source_address l source_username

USM Anywhere™ Deployment Guide

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.iis.net/learn/troubleshoot

Supported Plugins

USM Anywhere™ Deployment Guide 356

Supported Plugins

Microsoft Windows IIS NXLog

When you configure MS Windows IIS NXLog integration to send log data to USM Anywhere, you can use the MS Windows IIS NXLog plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Microsoft

Web server

Syslog

Integrating Microsoft Windows IIS NXLog

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure NXLog to send log data to USM Anywhere l

See

Plugin Enablement

For plugin enablement information, see

Configuring Audit Classes for the syslog Plugin

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l timestamp_occured l source_address l destination_address l destination_port l source_username l request_user_agent l response_code l request_referrer

357 USM Anywhere™ Deployment Guide

l request_url l request_method l duration l event_name

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.iis.net/learn/troubleshoot

Supported Plugins

USM Anywhere™ Deployment Guide 358

Supported Plugins

NGINX

When you configure NGINX integration to send log data to USM Anywhere, you can use the NGINX plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

NGINX

Web server syslog https://www.nginx.com/resources/admin-guide/logging-and-monitoring/

Integrating NGINX

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure NGINX to send log data over syslog to USM Anywhere

1. Open

/etc/nginx/nginx.conf

2. Edit the logging directives error_log and access_log

, as shown: error_log syslog:server=<USM_Anywhere_IP>:514,tag=nginx debug access_log syslog:server=<USM_Anywhere_IP>:514,tag=nginx,severity=info

Where: severity can equal any of the following values, in increasing severity: l debug l info l notice l warn l error

(default) l crit l alert l emerg

Messages are logged at the selected level and all levels above that, if any.

Plugin Enablement

The Nginx plugin automatically processes all messages that have the syslog tag nginx.

359 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l timestamp_occured l bytes_out l response_code l request_url l time_zone l request_method l application_protocol l source_address l event_name l event_description l request_referrer l request_user_agent

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls /

USM Anywhere™ Deployment Guide 360

Supported Plugins

NXLog

When you configure Microsoft Windows NXLog integration to send log data from Sysmon,

MS Windows, and any other host event sources to USM Anywhere, you can use the NXLog plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Microsoft

Adapter syslog https://nxlog.co/documentation/nxlog-community-edition-reference-manualv20928#forwarding

Integrating NXLog

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To send log data from NXLog to the USM Anywhere sensor

1. In the nxlog.conf

configuration file, add an output module.

Module im_file

File

"/var/log/messages"

SavePos TRUE

</Input>

Module om_udp

Host <IP_Addres_USM_Anywhere>

Port 514

</Output>

2. Add a Route module to send logs from your chosen inputs to your chosen outputs.

Path in => out

</Route>

Plugin Enablement

The MS Windows NXLog plugin automatically processes all messages whose syslog tag matches the value

"eventlog”

361 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l authentication_mode l authentication_type l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l customfield_5 l customfield_6 l customfield_7 l customheader_0 l customheader_1 l customheader_2 l customheader_3 l customheader_4 l customheader_5 l customheader_6 l customheader_7 l destination_address l destination_hostname l destination_port l destination_process l destination_process_id

USM Anywhere™ Deployment Guide 362

Supported Plugins l destination_username l event_category l event_description l event_name l event_severity l event_subcategory l external_id l file_hash l file_hash_algorithm l file_name l log_json l malware_family l policy l rep_device_rule_id l security_group_name l sevent_subcategory l source_address l source_hostname l source_ntdomain l source_port l source_process l source_process_commandline l source_process_id l source_process_parent l source_process_parent_commandline l source_process_parent_process_id l source_userid l source_username

363 USM Anywhere™ Deployment Guide

l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://nxlog.co/documentation/nxlog-community-edition-reference-manualv20928#troubleshooting

Supported Plugins

USM Anywhere™ Deployment Guide 364

Supported Plugins

Oracle Audit Logs

When you configure Oracle Audit Logs integration to send log data to USM Anywhere, you can use the Oracle Audit Logs plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Oracle

Operating system syslog https://docs.oracle.com/cd/E36784_01/html/E37127/audittask-11.html

Integrating Oracle Audit Logs

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

This integration includes the following tasks: l

Specifying Audit Classes for syslog Output

Putting syslog Audit Records on the USM Anywhere Sensor

Archiving syslog Audit Log Files

You can instruct the audit service to copy some or all of the audit records in the audit queue to the syslog utility.

If you record both binary audit data and text summaries, the binary data provide a complete audit record, whereas the summaries filter the data for real-time review.

Configuring Audit Classes for the syslog Plugin

To configure audit classes for the syslog plugin

1. Select audit classes to be sent to the

audit_syslog

plugin, and make the plugin active.

# auditconfig -setplugin audit_syslog \ active p_flags=lo,+as,-ss

Note: You must preselect p_flags audit classes as either system defaults or in the audit flags of a user or a rights profile. Records are not collected for a class that is not preselected.

2. Configure the syslog utility by adding an audit notice entry to the syslog.conf

file.

365 USM Anywhere™ Deployment Guide

Supported Plugins

The entry includes the location of the log file.

# cat /etc/syslog.conf

audit.notice /var/adm/auditlog

3. Create the log file:

# touch /var/adm/auditlog

4. Set the log file permissions to 640:

# chmod 640 /var/adm/auditlog

5. Verify which system-log service is running:

# svcs system-log

STATE STIME FMRI online Nov_27 svc:/system/system-log:default disabled Nov 27 svc:/system/system-log:rsyslog

6. Refresh the configuration information for the active syslog service instance:

# svcadm refresh system/system-log:default

7. Refresh the audit service:

# audit -s

Note: The audit service reads the changes to the audit plugin when refreshed.

Specifying Audit Classes for syslog Output

In the following example, the syslog utility collects a subset of the preselected audit classes. The pf class is created in Example 3–15 of the vendor documentation.)

# auditconfig -setnaflags lo,na

# auditconfig -setflags lo,ss

# usermod -K audit_flags=pf:no jdoe

# auditconfig -setplugin audit_syslog \ active p_flags=lo,+na,-ss,+pf

The arguments to the auditconfig command instruct the system to collect all login/logout, nonattributable, and change-of-system-state audit records.

The audit_syslog plugin entry instructs the syslog utility to collect: l

All logins l

Successful, non-attributable events l

Failed changes of system state

The binary utility collects successful and failed calls to the pfexec command.

The syslog utility collects successful calls to the pfexec command.

USM Anywhere™ Deployment Guide 366

Supported Plugins

Putting syslog Audit Records on the USM Anywhere Sensor

You can change the audit.notice entry in the syslog.conf

file to point to the USM Anywhere

Sensor.

In this example, the name of the local system is sys1.1.

Visible after the ampersand (@), is the IP address of the USM Anywhere Sensor.

sys1.1 # cat /etc/syslog.conf

… audit.notice @<IP_address_of_USMAnywhere_Sensor>

The audit.notice entry in the syslog.conf

file on the USM Anywhere system points to the log file.

<IP_address_of_USMAnywhere_Sensor> # cat /etc/syslog.conf

… audit.notice /var/adm/auditlog

Archiving syslog Audit Log Files

Because the audit service can generate extensive output, manage the logs as documented on the logadm(1M) man page.

Plugin Enablement

The Oracle Audit Logs plugin automatically processes all messages when the raw message contains the value

"Oracle Audit"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l authentication_mode l customfield_0 l destination_user_privileges l destination_username l event_name l rep_device_address l rep_device_rule_id l session l source_address l source_port

367 USM Anywhere™ Deployment Guide

l source_process_user l source_username l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://docs.oracle.com/cd/E36784_01/html/E37127/audittask-84.html

Supported Plugins

USM Anywhere™ Deployment Guide 368

Supported Plugins

OSSEC

When you configure OSSEC integration to send log data to a deployed USM Anywhere

AWS sensor, you can use the OSSEC plugin to translate the raw log data into normalized events for analysis.

OSSEC is an open-source, host-based intrusion detection system that performs the following functions: l

Log analysis l

File integrity checking l

Policy monitoring l

Rootkit detection l

Real-time alerting l

Active response

Integrating OSSEC

If you already have a working OSSEC installation and want to integrate the alerts with your

USM Anywhere AWS account, follow this procedure. Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To integrate OSSEC into USM Anywhere on AWS

1. Make sure that there is connectivity between the machine running the OSSEC server and a

USM Anywhere sensor deployed in your AWS account.

2. Configure the OSSEC server to send alerts to USM Anywhere over syslog: a. Open

/var/ossec/etc/ossec.conf.

b. Add the following directive under ossec_config

<syslog_output>

USM-ANYWHERE-ADDRESS</server>

<port>

514</port>

<level>

0</level>

</syslog_output>

Where:

USM-ANYWHERE-ADDRESS = the IP address of the USM Anywhere sensor

369 USM Anywhere™ Deployment Guide

Supported Plugins c. Enable syslog output and restart the OSSEC server:

/var/ossec/bin/ossec-control enable client-syslog

/var/ossec/bin/ossec-control restart

3. Verify that OSSEC activated syslog output:

$ tail -n 1000 /var/ossec/logs/ossec.log | grep csyslog ossec-csyslogd: INFO: Started (pid: 19412).

ossec-csyslogd: INFO: Forwarding alerts via syslog to: ‘USM_ADDRESS:514′.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l destination_address l destination_port l event_category l event_description l event_name l file_hash l file_name l file_old_hash l rep_device_rule_id l source_address l source_port l source_username

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://ossec-docs.readthedocs.io/en/latest/faq/unexpected.html

USM Anywhere™ Deployment Guide 370

Supported Plugins

Palo Alto Networks PAN-OS

When you configure Palo Alto Networks PAN-OS to send log data to USM Anywhere, you can use the Palo Alto Networks PAN-OS plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Palo Alto Networks

Firewall

Syslog

Integrating Palo Alto Networks PAN-OS

Before you configure the Palo Alto Networks PAN-OS integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Palo Alto Networks PAN-OS to send log data to USM Anywhere

1. Create a syslog server profile on the firewall: a. Go to Device > Server Profiles > Syslog.

b. In the Profile Name field, enter a name for the profile (for example, USM Anywhere).

Click Add, then enter a name for the syslog server (USM Anywhere Sensor), as well as other details: l

Name of the syslog server: Typically, the name of the USM Anywhere Sensor l

Syslog server: IP address of USM Anywhere Sensor l

Transport: UDP l

Port: 514 l

Format: BSD (default) or IETF l

Facility: Select the value that maps to how the USM Anywhere Sensor uses the facility field to manage messages.

For details on the facility field, see RFC 3164 (BSD format).

c. Click OK.

To make integration with external log parsing systems easier, the firewall allows you to

371 USM Anywhere™ Deployment Guide

Supported Plugins customize the log format. It also allows you to add custom

Key: Value attribute pairs.

Note: To configure custom formats, go to Device > Server Profiles > Syslog >

Syslog Server Profile > Custom Log Format.

2. Create a log forwarding profile: a. Go to Objects > Log forwarding > Add.

b. Complete the required details: l

Name: Type a profile name. This name appears in the list of log forwarding profiles when defining security policies.

Syslog: Select the syslog server profile to specify additional destinations to which the traffic log entries should be sent.

c. Click OK.

Your log forwarding profile should now be created.

3. Use the log forwarding profile in your security policy.

a. Go to Policies > Security.

b. Select the rule for which log forwarding should be applied.

c. Select the Actions tab, then select your log forwarding profile from the Log Forwarding list, on the right side of the page.

d. Verify that Log at Session End is selected.

e. Click OK.

After clicking OK, notice the forwarding icon in the Options column of your security rule.

f. Click Commit.

Plugin Enablement

The Palo Alto Networks Pan-OS plugin will automatically process all messages whose syslog tag matches the following regular expression:

"TRAFFIC,(start|end|drop|deny)|THREAT,

USM Anywhere™ Deployment Guide 372

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l audit_reason l base_event_count l bytes_in l bytes_out l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customfield_4 l customfield_5 l customfield_6 l destination_address l destination_nat_address l destination_port l destination_username l destination_zone l device_direction l email_recipient l email_sender l email_subject l event_category l event_description l event_name l event_severity l event_subcategory l file_hash l file_name l file_type

373 USM Anywhere™ Deployment Guide

Supported Plugins l rep_device_inbound_interface l rep_device_outbound_interface l rep_device_rule_id l request_content_type l request_url l request_user_agent l session l source_address l source_nat_address l source_port l source_process_commandline l source_username l source_zone

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/monitoring/configure-syslogmonitoring.html

http://blog.webernetz.net/2013/11/21/cli-commands-for-troubleshooting-palo-alto-firewalls/

USM Anywhere™ Deployment Guide 374

Supported Plugins

ProFTPD

When you configure ProFTPD integration to send log data to USM Anywhere, you can use the

ProFTPD plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

ProFTPD

FTP server syslog http://www.proftpd.org/docs/howto/Logging.html

and http://www.proftpd.org/docs/howto/LogLevels.html

Integrating ProFTPD

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

ProFTPD logs through syslog by default, using the daemon facility for most logging. However, auth is also used occasionally. The following levels can be selected: l err l notice l warn l info l debug (debugging occurs at the syslog level)

The location of the server's log files in this case is determined by your

/etc/syslog.conf

configuration.

You can fine-tune syslog-based logging by ProFTPD through the

SyslogFacility and

SyslogLevel directives. See the vendor's log level documentation for more details on these settings.

Transfer logs ( xferlogs

) do not go to syslog. An

ExtendedSyslog directive can substitute for this, however:

LogFormat xfer "%h %l %u %t\"%r\" %s %b"

ExtendedLog syslog:notice xfer

You must also tell the syslog server to send this log output to another server, in this case, your

USM Anywhere sensor, and to write it to a log file.

The normal Linux syslog uses a file called

/etc/syslog.conf

(or some variant of this) to configure how syslog streams. Because the Apache error log uses syslog-standard severity ratings, you can use normal syslog configurations to split syslog output into different files based on severity.

375 USM Anywhere™ Deployment Guide

Supported Plugins

To send log entries to your USM Anywhere sensor, you can use this command: if $programname == 'proftpd' then @<USM_Anywhere_Sensor_IP_address>

& ~

Plugin Enablement

The ProFTPD plugin automatically processes all messages that have proftpd as the syslog tag.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l audit_reason l customfield_0 l destination_address l destination_hostname l destination_username l event_description l event_name l file_path l rep_device_version l source_address

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.proftpd.org/docs/faq/linked/faq-ch4.html

USM Anywhere™ Deployment Guide 376

Supported Plugins

RSA Authentication Manager

When you configure RSA Authentication Manager integration to send log data to USM Anywhere, you can use the RSA Authentication Manager plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

RSA

Authentication syslog https://www.emc.com/collateral/15-min-guide/h12276-am8-administrators-guide.pdf

Integrating RSA Authentication Manager

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To integrate RSA Authentication Manager to send log data to USM Anywhere in an

MS Windows environment

1. Log in to the system that hosts your RSA Security Console.

2. Open the following file for editing based on your operating system:

/Program Files/RSASecurity/RSAAuthenticationManager/utils/ resources/ims.properties

3. Add the following entries to the ims.properties

file: ims.logging.audit.admin.syslog_host = <IP address> ims.logging.audit.admin.use_os_logger = true ims.logging.audit.runtime.syslog_host = <IP address> ims.logging.audit.runtime.use_os_logger = true ims.logging.system.syslog_host = <IP address> ims.logging.system.use_os_logger = true

Where

<IP_address> is the IP address or host name of the USM Anywhere Sensor.

4. Save the ims.properties files.

5. Restart RSA services.

377 USM Anywhere™ Deployment Guide

Supported Plugins

To integrate RSA Authentication Manager to send log data to USM Anywhere in a Linux environment

1. Log in to the RSA Security Console command-line interface (CLI).

2. Open the following file for editing based on your operating system:

/usr/local/RSASecurity/RSAAuthenticationManager/utils/resources

/ims.properties

3. Add the following entries to the ims.properties file: ims.logging.audit.admin.syslog_host = <IP address> ims.logging.audit.admin.use_os_logger = true ims.logging.audit.runtime.syslog_host = <IP address> ims.logging.audit.runtime.use_os_logger = true ims.logging.system.syslog_

host = <IP address> ims.logging.system.use_os_logger = true

Where:

<IP address> is the IP address of the USM Anywhere Sensor

4. Save the ims.properties files.

5. Open the following file for editing:

/etc/syslog.conf

6. Enter the following command to add the USM Anywhere Sensor as a syslog entry:

*.* @<IP address>

Where:

<IP address> is the IP address of the USM Anywhere Sensor.

7. Enter the following command to restart the syslog services for Linux.

service syslog restart

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l account_name l authentication_type l event_description

USM Anywhere™ Deployment Guide 378

Supported Plugins l event_name l event_outcome l event_severity l file_path l rep_device_address l rep_device_hostname l rep_device_rule_id l source_address l source_username l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://community.rsa.com/docs/DOC-36951

379 USM Anywhere™ Deployment Guide

Supported Plugins

Ruckus Wireless ZoneDirector

When you configure Ruckus Wireless ZoneDirector integration to send log data to USM Anywhere, you can use the Ruckus Wireless ZoneDirector plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Ruckus

Wireless security/management syslog https://support.ruckuswireless.com/documents/292-zonedirector-syslog-eventmessage-reference-guide

Integrating Ruckus Wireless ZoneDirector

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Ruckus ZoneDirector to send log data through syslog to USM Anywhere

1. Log onto the ZoneDirector Web Interface.

2. Go to Configure / System.

3. Look for the Log Settings section.

4. Click Enable reporting to remote syslog server at ___ (IP Address).

5. Type the USM Anywhere Sensor's IP address into the field referenced in step 4.

6. Click Apply.

USM Anywhere™ Deployment Guide 380

Supported Plugins

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports. In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_4 l customheader_4 l event_name l plugin_device l plugin_rule l source_address l source_hostname l source_mac l source_port l source_username l wireless_ap l wireless_bssid l wireless_channel l wireless_ssid

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://support.ruckuswireless.com/answers/browse/2-Troubleshooting

381 USM Anywhere™ Deployment Guide

Supported Plugins

Sophos Cyberoam

When you configure Sophos Cyberoam integration to send log data to USM Anywhere, you can use the Sophos Cyberoam plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Sophos

Firewall syslog https://kb.cyberoam.com/default.asp?id=1709

Cyberoam Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Cyberoam to send log data to USM Anywhere

1. On the Cyberoam Firewall, go to Logs & Reports > Configuration > Syslog Server and click

Add.

2. Configure the syslog server (USM Anywhere sensor) by providing values for these parameters: l

Name — USM Anywhere l

IP Address — USM Anywhere sensor IP Address l

Port — 514 l

Facility — DAEMON l

Severity Level — Debug l

Format — CyberoamStandardFormat

3. Click OK.

4. Specify the logs to be stored in the USM Anywhere sensor: a. Go to Logs & Reports > Configuration > Log Settings.

b. Specify the kinds of logs to be recorded in the USM Anywhere sensor you just configured as the syslog server.

c. Verify the required types of logs.

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 382

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

Note: The custom fields shown below are prefilled with the values shown. You cannot change these.

l application l authentication_mode l bytes_in l bytes_out l customfield_0 → dir_disp l customfield_1 → connevent l customfield_2 → src_country_code l customfield_3 → dst_country_code l customfield_4 → appfilter_policy_id l customfield_5 → ips_policy_id l customfield_6 → srczonetype l customfield_7 → dstzonetype l destination_address l destination_dns_domain l destination_mac l destination_port l destination_translated_address l destination_translated_port l device_inbound_interface l device_outbound_interface l duration l email_recipient

383 USM Anywhere™ Deployment Guide

l email_sender l email_subject l event_action l event_category l event_name l event_severity l event_type l packets_sent l packets_received l policy l rep_device_model l rep_device_rule_id l request_content_type l request_model l request_url l source_address l source_dns_domain l source_mac l source_port l source_translated_address l source_username l time_zone l timestamp_occurred l transport_protocol l user_group_id

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://kb.cyberoam.com/default.asp?id=2075

USM Anywhere™ Deployment Guide

Supported Plugins

384

Supported Plugins

Sophos Enterprise Console

When you configure Sophos Enterprise Console integration to send log data to USM Anywhere, you can use the Sophos Enterprise Console plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Sophos

Endpoint security syslog

See the

Sophos Report Writer User Guide website at https://www.sophos.com

in PDF format on the vendor

Integrating Sophos Enterprise Console

Before you configure the integration, you must have: l

IP Address of the USM Anywhere sensor l

.NET Framework 3.5

Sufficient privileges to install a new service on the machine where you intend to install LogWriter

You must also download and install the Sophos Report Writer to complete this task.

To configure Sophos Enterprise Console to send log data to USM Anywhere

1. Go to http://www.sophos.com/en-us/support/downloads.aspx

2. Enter your MySophos username and password.

A web page appears, showing your licenses.

3. Under your license name, find the Console downloads, then download the Sophos Reporting

Interface installer.

4. Go to the download location and double-click the installer to launch it.

5. (Optional) Change the destination folder where the installation files are copied.

6. Click Install.

The installer copies the installation files to the machine.

7. Locate the file

Sophos Reporting Log Writer.msi

and indicate whether or not you want to run a verbose log during installation of the Log Writer:

385 USM Anywhere™ Deployment Guide

Supported Plugins l

To generate a verbose log, enter: msiexec /l*v logfile.txt /i "Sophos Reporting Log Writer.msi"

The installer creates the log in the directory in which you executed the command.

To not generate a log, double-click the installer.

The Sophos Reporting Log Writer Setup wizard launches and guides you through the installation.

8. When installation has completed, click Finish.

If you selected the Show configuration file check box, the default configuration file

SophosLogWriterConfig.xml

appears in Windows Explorer.

9. To forward the output file to USM Anywhere, using syslog, use the free, open-source version of

NxLog at https://lkhill.com/nxlog-convert-to-syslog/ .

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l audit_reason l customfield_0 l customfield_11 l customfield_12 l customfield_13 l customfield_8 l customheader_0 l customheader_11 l customheader_12 l customheader_13 l customheader_8 l device_event_category

USM Anywhere™ Deployment Guide 386

Supported Plugins l event_action l event_category l event_name l event_subcategory l file_path l malware_family l malware_variant l operating_system l rep_device_rule_id l rep_device_type l request_referrer l security_group_name l source_address l source_hostname l source_ntdomain l source_username

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.sophos.com/en-us/support/documentation/enterprise-console.aspx

387 USM Anywhere™ Deployment Guide

Supported Plugins

Sophos UTM

When you configure Sophos UTM integration to send log data to USM Anywhere, you can use the

Sophos UTM plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Sophos

UTM syslog https://www.emc.com/collateral/15-min-guide/h12276-am8-administrators-guide.pdf

Integrating Sophos UTM

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure logging for iView

1. Log onto the WebAdmin of the UTM.

2. Navigate to Logging & Reporting > Log Settings > Remote Syslog Server.

3. Activate the Remote Syslog status.

4. Configure a syslog server: l

Name — Freely selectable l

Server — IP or hostname of your Sophos iView l

Port — UDP 514

5. Click Apply.

6. Log onto Sophos iView and do the following: a. Navigate to System > Configuration > Device.

A new device should appear with the designation "device ID: new." b. Provide a name for this device.

c. Activate the device.

d. Save your changes

The Sophos UTM should now log everything to your Sophos iView.

Plugin Enablement

SecureMail

USM Anywhere™ Deployment Guide 388

Supported Plugins

SecureWeb

SecureNet

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l audit_reason l bytes_out l content_category l customfield_0 l customfield_5 l customfield_6 l customfield_7 l destination_address l destination_mac l destination_port l device_event_category l email_recipient l email_sender l event_action l event_category l event_description l event_name l event_severity l event_subcategory l http_hostname l malware_family l rep_device_rule_id l request_method l request_url l request_user_agent l response_code l source_address

389 USM Anywhere™ Deployment Guide

l source_mac l source_ntdomain l source_port l source_username l timestamp_occured l timestamp_received l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://community.sophos.com/kb/en-US/115025

Supported Plugins

USM Anywhere™ Deployment Guide 390

Supported Plugins

Sophos Web Security

When you configure Sophos Web Security integration to send log data to USM Anywhere, you can use the Sophos Web Security plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Sophos

Web security device syslog http://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.dsm.doc/ t_DSM_guide_Sophos_WSA_syslog.html

Sophos Web Security Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Sophos Web Security to forward log data to USM Anywhere sensor

1. Log into your Sophos Web Security appliance.

2. From the menu, select Configuration > System > Alerts & Monitoring.

3. Select the Syslog tab.

4. Select Enable syslog transfer of web traffic.

5. In the Hostname/IP field, enter the IP address or host name of the USM Anywhere sensor.

6. In the Port text box, type 514.

7. From the Protocol list, select UDP protocol.

8. Click Apply.

Plugin Enablement

For plugin enablement information, see

391 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l bytes_in l bytes_out l content_category l destination_address l event_name l event_severity l plugin_device l request_content_type l request_method l request_url l request_user_agent l response_code l source_address l source_username

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://community.sophos.com/kb/en-us/122936

USM Anywhere™ Deployment Guide 392

Supported Plugins

Sophos XG Firewall

When you configure Sophos XG Firewall to send log data to USM Anywhere, you can use the

Sophos XG plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Sophos

Firewall

Syslog

Integrating Sophos XG

Before you configure the Sophos XG integration, you must have the IP Address of the USM

Anywhere Sensor.

To configure Sophos XG to send log data to USM Anywhere

1. In the Sophos XG console, go to System > System Services > Log Settings and, under the

Syslog Servers section, click Add.

2. Enter the server details: l

Name — Unique name for your instance.

IP Address / Domain — Specify the IP address (IPv4 or IPv6)/ domain for your sensor.

Port — 514 l

Facility — Syslog facility for logs sent to the Sensor. Facility indicates to the source of a log such as the operating system, the process or an application. It is defined by the syslog protocol.

The device supports several syslog facilities for received logs.

Available options: l

DAEMON l

KERNEL l

LOCAL0 - LOCAL7 l

USER l

Severity Level:

393 USM Anywhere™ Deployment Guide

Supported Plugins l

EMERGENCY — System is not usable l

ALERT — Action must be taken immediately l

CRITICAL — Critical condition l

ERROR — Error condition l

WARNING — Warning condition l

NOTIFICATION — Normal but significant condition l

INFORMATION — Informational l

DEBUG — Debug level messages.

Unless a specific device format is chosen, the device produces logs in its standard format.

Note: You can configure a maximum of five syslog servers.

3. Click Save.

4. On System > System Services > Log Settings, enable all those logs that you want sent to the sensor.

Plugin Enablement

The Sophos XG plugin will automatically process all messages whose syslog tag matches the following regular expression:

"date=\\S+\\s+time=\\S+\\s+timezone="

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application l authentication_mode l bytes_in l bytes_out l customfield_0 l customfield_1 l customfield_2 l customfield_3 l customheader_0 l customheader_1 l customheader_2 l customheader_3

USM Anywhere™ Deployment Guide 394

Supported Plugins l destination_address l destination_dns_domain l destination_mac l destination_port l destination_translated_address l destination_translated_port l destination_zone l device_external_id l device_inbound_interface l device_outbound_interface l duration l email_recipient l email_sender l email_subject l event_action l event_category l event_description l event_name l event_outcome l event_severity l event_type l packets_received l packets_sent l policy l rep_device_model l rep_device_rule_id l rep_device_type l reputation_score l request_content_type l request_url l response_code l source_address l source_dns_domain

395 USM Anywhere™ Deployment Guide

l source_mac l source_port l source_translated_address l source_translated_port l source_username l source_zone l time_zone l timestamp_occured l timestamp_received l transport_protocol l user_group_id l wireless_ap l wireless_ssid

Additional Resources and Troubleshooting https://www.sophos.com/en-us/medialibrary/PDFs/documentation/Sophos-XG-Firewall-

Administrator-Guide.pdf?la=en

For troubleshooting, refer to the vendor documentation: https://community.sophos.com/kb?TopicId=10001

Supported Plugins

USM Anywhere™ Deployment Guide 396

Supported Plugins

Squid Proxy

When you configure Squid Proxy integration to send log data to USM Anywhere, you can use the

Squid Proxy plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Squid

Proxy syslog http://eric.lubow.org/2007/system-administration/syslog-ng-and-squid-logging/

Integrating Squid Proxy

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Squid Proxy to send log data to the USM Anywhere sensor

1. Go to /etc/squid/squid.conf and find the line that begins with the access_log directive.

It should look like this: access_log /var/log/squid/squid.log squid

2. Configure remote logging as an addition to current local logging by adding the following line to squid.conf

: access_log syslog squid

This tells Squid to create another access_log file, and to log it to the syslog in the standard squid logging format.

Note: Two copies are better than one, especially if you can spare the space and handle the network traffic.

3. Make sure that Squid is not logged twice on your machine by adding the following lines to syslog-ng.conf

# The filter removes all entries that come from the

# program 'squid' from the syslog filter f_remove { program("squid"); };

# Everything that should be in the 'user' facility filter f_user { facility(user); };

# The log destination should be the '/var/log/user.log' file destination df_user { file("/var/log/user.log"); };

# The log destination should be sent via UDP destination logserver { udp("logserver.mycompany.com"); };

# The actual logging directive

397 USM Anywhere™ Deployment Guide

Supported Plugins log {

# Standard source of all sources source(s_all);

# Apply the 'f_user' filter filter(f_user);

# Apply the 'f_remove' filter to remove all squid entries filter(f_remove);

# Send whatever is left in the user facility log file to

# to the 'user.log' file destination(df_user);

# Send it to the logserver destination(logserver);

};

4. Save the file.

Plugin Enablement

The Squid plugin automatically processes all messages whose syslog tag matches the value

"squid"

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l bytes_out l customfield_0 l customfield_1 l customheader_0 l customheader_1 l event_description l event_name l plugin_device l plugin_device_version l request_method l request_referrer l request_url l request_user_agent

USM Anywhere™ Deployment Guide 398

Supported Plugins l response_code l source_address l time_zone

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.linuxnix.com/troubleshooting-squid-reverse-proxy-server/

399 USM Anywhere™ Deployment Guide

Supported Plugins

Symantec EPM

When you configure Symantec EPM integration to send log data to USM Anywhere, you can use the

Symantec EPM plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Symantec

Endpoint management syslog http://www.symantec.com/connect/forums/external-logging-syslog-server

Integrating Symantec EPM

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Symantec EPM to send log data to the USM Anywhere sensor

1. In the console, click Admin.

2. Click Servers.

3. Click the local site or remote site that you want to export log data from.

4. Click Configure External Logging.

5. On the General2 tab, in the Update Frequency list box, select how often to send the log data to the file.

6. In the Master Logging Server list box, select the management server to send the logs to.

Note: If you use SQL Server and connect multiple management servers to the database, specify only one server as the Master Logging Server.

7. Check Enable Transmission of Logs to a Syslog Server.

8. Provide the following information: a. Syslog Server — Enter the IP address or domain name of the USM Anywhere sensor that you want to receive the log data.

b. Destination Port — Select UDP as the protocol to use, and type 514 as the destination port that the USM Anywhere sensor uses to listen for syslog messages.

c. Log Facility — Enter the number of the log facility that you want to the syslog configuration file to use, or use the default.

USM Anywhere™ Deployment Guide 400

Supported Plugins

Valid values range from 0 to 23.

9. On the Log Filter tab, select the logs you want to export.

10. Click OK.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l app_name l audit_reason l destination_address l destination_hostname l destination_mac l destination_port l event_action l event_description l event_name l event_outcome l file_hash l file_name l file_path l malware_family l policy l rep_device_hostname l rep_device_rule_id l request_url l security_group_name l source_address l source_hostname l source_mac l source_ntdomain

401 USM Anywhere™ Deployment Guide

l source_port l source_process l source_process_commandline l source_username l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.symantec.com/content/dam/symantec/docs/education/endpoint-protection-12-1maintain-and-troubleshoot-course-desc-generic-en.pdf

Supported Plugins

USM Anywhere™ Deployment Guide 402

Supported Plugins

Trend Micro Control Manager

When you configure Trend Micro Control Manager integration to send log data to USM Anywhere, you can use the Trend Micro Control Manager plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Trend Micro

Antivirus syslog

See the

Trend Micro Control Manager 6.0 Service Pack 3 Administrator's Guide the vendor's website.

Trend Micro Control Manager Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

You can use either the Trend Micro Control Manager console or the CLI.

Web Console

To configure Trend Micro Control Manager to send log data to USM Anywhere

1. Log into the Trend Micro Control Manager console.

2. Go to Administration > Event Center > General2 Event Settings.

3. Go to the Setting Syslog section and type the IP address of your USM Anywhere Sensor and port 514.

4. Select the facility for syslog from the list.

5. Click Save.

CLI

To configure Trend Micro Control Manager to send log data to USM Anywhere

1. Go to the Control Manager root folder at either

C:\Program Files\Trend Micro\Control

Manager or

C:\Program Files (x86)\Trend Micro\Control Manager

2. Launch

DataExportTool.exe

3. Configure log receiver settings:

403 USM Anywhere™ Deployment Guide

Supported Plugins a. Severity = Default: Notice b. IP address = USM Anywhere sensor c. Port = 514 d. Facility= Syslog facility. Default: Local0.

4. Configure log forwarding settings: a. Frequency = How often Syslog Forwarder should query Control Manager for logs. Default:

12 hours.

b. Logs to forward = Log types. Default: no selection.

c. Format = CEF or Control Manager format.

5. Click Start.

Plugin Enablement

The Trend Micro Control Manager plugin automatically processes all messages whose syslog tag matches the value "TMCM”.

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l destination_address l destination_hostname l event_name l event_outcome l file_name l file_path l malware_family l rep_device_hostname l rep_device_model l rep_device_rule_id l source_address

USM Anywhere™ Deployment Guide 404

Supported Plugins l source_hostname l source_ntdomain l source_username l timestamp_occurred

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://success.trendmicro.com/product-support/control-manager

405 USM Anywhere™ Deployment Guide

Supported Plugins

Trustwave Secure Web Gateway

When you configure Trustwave Secure Web Gateway integration to send log data to USM

Anywhere, you can use the Trustwave Secure Web Gateway plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device type

Connection type

Vendor link

Details

Trustwave

Unified threat management syslog

For information, see the Trustwave Secure Web Gateway v11 User Guide

(pdf) on the vendor website.

Integrating Trustwave Secure Web Gateway

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure Trustwave Secure Web Gateway to forward log data to USM Anywhere

1. In the Syslog Target tab of the Log Properties screen, using the top set of entry fields on a

Facility line, beginning with Facility1 to define a facility.

Note: You must do this for each of the following for each message type, System Log,

Scanner, and/or Audit, that you plan to send to USM Anywhere.

a. In the Facility Mode field, select a mode label, and use this label to differentiate Trustwave logs from each other and from other platforms’ logs on the remote syslog server.

b. In the Primary IP field, specify the USM Anywhere sensor IP address. c. In the Primary Port field, specify 514.

2. In the bottom set of entry fields, select the checkbox associated with each message type you want to send to syslog, then select the facility that you defined for it.

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 406

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l customfield_0 → Changes commited l customfield_1 → View l customfield_2 → Update l destination_address l destination_hostname l destination_username l event_action l event_name l event_outcome l event_type l policy l rep_device_hostname l timestamp_occured l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation:

Trustwave Secure Web Gateway v11 User Guide

407 USM Anywhere™ Deployment Guide

Supported Plugins

Vectra Networks X-Series

When you configure Vectra Networks X-Series integration to send log data to USM Anywhere, you can use the Vectra Networks X-Series plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

Vectra Networks

Unified threat management syslog

See the Vectra Networks X-Series Deployment Guide(pdf) on the vendor website.

Vectra Networks X-Series Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure the Vectra Networks X-Series to send log data to USM Anywhere

1. Log into the Vectra Networks X-Series console and go to Settings > Notifications.

2. Scroll to the bottom of the page and under the syslog section, click Edit.

3. Enter the following into the respective fields: a. Destination= IP address of the USM Anywhere sensor b. Port = 514 c. Protocol = UDP d. Format = CEF

This completes the configuration.

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 408

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l application_protocol l base_event_count l bytes_in l bytes_out l confidence l customfield_4 l customheader_4 l destination_address l destination_hostname l destination_port l device_custom_number_1 l device_custom_number_1_label l device_custom_number_2 l device_custom_number_2_label l device_custom_number_3 l device_custom_number_3_label l device_event_category l event_description l event_description_url l event_name l event_severity l external_id l plugin_device l rep_device_address

409 USM Anywhere™ Deployment Guide

l rep_device_rule_id l rep_device_type l rep_device_vendor l rep_device_version l reputation_score l source_address l source_hostname l source_port l time_end l time_start l transport_protocol

Troubleshooting

For troubleshooting, see the vendor documentation.

Supported Plugins

USM Anywhere™ Deployment Guide 410

Supported Plugins

VMware ESXi

When you configure VMware ESXi integration to send log data to USM Anywhere, you can use the

VMware ESXi plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

VMware

Hypervisor

Syslog https://kb.vmware.com/selfservice/microsites/search.do?language=en_

US&cmd=displayKC&externalId=2003322

Integrating VMware ESXi

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure VMware ESXi to send log data to USM Anywhere

1. Open an ESXi Shell console session where the esxcli command is available, such as vCLI, or on the ESXi host directly.

2. Display the existing five configuration options on the host by running the command: esxcli system syslog config get

3. Set a new host configuration, specifying options to change by entering: esxcli system syslog config set --logdir= </path/to/vmfs/directory/> -loghost= <RemoteHost_IP> --logdir-unique={true|false} --default-rotate=

<nnn> --default-size= <nnn>

Warning: Entering an incorrect logging path can cause the destination to become unmanageable!

Example of remote syslog configuration on port 514, using UDP esxcli system syslog config set --loghost='udp://10.11.12.13:514'

Note: If using syslog with UDP, you must download a patch on the ESXi host . For more information, see

VMware ESXi 5.0, Patch ESXi-5.0.0-20120704001-standard

(2019113)

4. After making configuration changes, load the new configuration: esxcli system syslog reload

411 USM Anywhere™ Deployment Guide

Supported Plugins

Note: You may also use this command to restart the syslog service if the service is stopped.

5. Test whether or not the port is reachable from the ESXi host: nc -z <RemoteHost_IP_address> 514

Example nc -z 10.11.12.13 514

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports. In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l apcustomfield_1 l customfield_2 l customfield_4 l customfield_5 l event_description l event_name l event_severity l rep_device_hostname l rep_device_version l source_address l source_port l source_process l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.pearsonitcertification.com/articles/article.aspx?p=2241144

USM Anywhere™ Deployment Guide 412

Supported Plugins

VMware vCenter

When you configure VMware vCenter integration to send log data to USM Anywhere, you can use the VMware vCenter plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

VMware

Virtual machine management syslog https://www.vmware.com/products/vcenter-server.html

Integrating VMware vCenter

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

Linux Machine

To configure VMware vCenter to send log data to USM Anywhere

1. Establish an ssh connection to the VMware vCenter Server and log in as the root user.

2. Go to

/etc/syslog-ng/

3. Copy and paste the following string at the end of the

/etc/syslog-ng/syslog-ng.conf

file on the VCenter Server:

# vpxd source log source vpxd { file("/var/log/vmware/vpx/vpxd.log" follow_freq(1) flags(no-parse)); file("/var/log/vmware/vpx/vpxd-alert.log" follow_freq(1) flags(no-parse)); file("/var/log/vmware/vpx/vws.log" follow_freq(1) flags(no-parse)); file("/var/log/vmware/vpx/vmware-vpxd.log" follow_freq(1) flags(noparse)); file("/var/log/vmware/vpx/inventoryservice/ds.log" follow_freq(1) flags

(no-parse));

};

# Remote USM Anywhere Appliance destination remote_syslog { udp("<n.n.n.n>" port (514));

};

# Log vCenter Server vpxd log remotely log { source(vpxd); destination(remote_syslog);

};

413 USM Anywhere™ Deployment Guide

Supported Plugins

Where:

<n.n.n.n>

= the IP address or hostname of the USM Anywhere sensor

4. Restart the syslog service on the vCenter Server: service syslog restart

MS Windows Machine

For instructions on integrating VMware vCenter on an MS Windows machine, see http://www.thevirtualist.org/sending-vcenter-logs-centralized-syslog-server-using-nxlog/ .

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

USM Anywhere™ Deployment Guide 414

Supported Plugins l source_userid l source_username l timestamp_occured l timestamp_received l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://www.vmware.com/support/vcenter-server.html

415 USM Anywhere™ Deployment Guide

Supported Plugins

VMware vShield

When you configure VMware vShield integration to send log data to USM Anywhere, you can use the VMware vShield plugin to translate the raw log data into normalized events for analysis.

Device

Device vendor

Device type

Connection type

Vendor link

Details

VMware

Management platform syslog

See the PDF vShield Administration Guide vShield Manager 5.1

, available on the vendor's website under http://www.vmware.com/support/

VMware vShield Integration

Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.

To configure vShield to send log data to USM Anywhere

1. Log into the vShield Manager web interface.

2. From the vShield Manager Inventory panel, select Settings & Reports.

3. Click the Configuration tab.

You should now be in the Configuration > General2 tab.

4. Next to the Syslog Server section, click Edit.

a. Syslog Server = Enter the IP address of the USM Anywhere sensor.

b. Port = Type 514 for the port.

5. Click OK.

Plugin Enablement

For plugin enablement information, see

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l customfield_0 l customfield_1 l customheader_0

USM Anywhere™ Deployment Guide 416

Supported Plugins l customheader_1 l event_name l source_username l timestamp_occured

Troubleshooting

For troubleshooting, refer to the vendor documentation: vShield Administration Guide vShield Manager 5.1, available at http://www.vmware.com/support/

417 USM Anywhere™ Deployment Guide

Supported Plugins

Watchguard XTM

When you configure Watchguard XTM Firewall to send log data to USM Anywhere, you can use the

Watchguard XTM plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Watchguard

Firewall

Syslog

Integrating WatchGuard XTM

Before you configure the WatchGuard XTM integration, you must have the IP Address of the USM

Anywhere Sensor.

To configure WatchGuard XTM to send log messages to USM Anywhere

1. From the device console, go to System > Logging.

2. Click the Syslog Server tab.

3. Select the Send log messages to the syslog server at this IP address checkbox and specify the following parameters: l

IP Address — IP address of the USM Anywhere Sensor.

Port — The USM Anywhere Sensor port for UDP is preselected.

Log Format — Expand the list and select syslog.

4. Under Select the details to include in Syslog Messages, select: l

Timestamp l

Serial Number of the Device

Plugin Enablement

For plugin enablement information, see

USM Anywhere™ Deployment Guide 418

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l application l bytes_in l bytes_out l content_category l destination_address l destination_hostname l destination_port l destination_username l device_event_category l duration l email_recipient l email_sender l event_action l event_category l event_name l event_severity l file_hash l file_hash_algorithm l file_name l file_path l http_hostname l malware_variant l priority l rep_device_rule_id l reputation_score l request_content_type l request_method l request_url

419 USM Anywhere™ Deployment Guide

Supported Plugins l source_address l source_port l source_username l timestamp_occured l timestamp_received l tls_subject l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: http://www.watchguard.com/wgrd-help/documentation/xtm

Websense Web Security Gateway

When you configure Websense Web Security Gateway to send log data to USM Anywhere, you can use the Websense plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details

Websense

Application Firewall

Syslog

Note: There is also atriton plugin provided for integration with versions of the Web Security

Gateway product released after ForcePoint acquired Websense.

Integrating Web Security Gateway

Before you configure the Websense Web Security integration, you must have the IP Address of the

USM Anywhere Sensor.

To configure Websense Web Security to send log data to USM Anywhere

Each Websense Web Security policy server instance in your deployment must be configured to send log data to a USM Anywhere Sensor over the Syslog protocol.

To configure Websense software to send log data to USM Anywhere, you can perform the following steps from the Settings > General > SIEM Integration page.

Note: Before using this page to enable USM Anywhere integration, make sure that an instance of Websense Multiplexer is installed for each policy server in your environment.

USM Anywhere™ Deployment Guide 420

Supported Plugins

1. Select Enable SIEM integration for this Policy Server to enable SIEM integration.

2. Provide the IP address or hostname of the machine hosting USM Anywhere, as well as the communication port to use for sending data.

3. Specify the Transport protocol (UDP) to use when sending data to the SIEM product (USM Anywhere).

4. Select the SIEM format to use. This determines the syntax of the string used to pass log data to the integration.

The available formats are syslog/CEF (ArcSight), syslog/key-value pairs (Splunk and others), syslog/LEEF (QRadar), and Custom. Choose syslog/key-value pairs (Splunk and others).

If you select a non-custom option, a sample Format string showing fields and value keys is displayed.

5. Click OK to cache your changes. Changes are not implemented until you click Save and

Deploy.

After you save your changes, Websense Multiplexer connects to the Filtering Service and takes over the job of distributing log data to both Log Server and the selected SIEM (USM Anywhere) integration.

Note that although the same data is passed from the WebSense Filtering Service to both Log Server and the SIEM product, Log Server may be configured to perform data reduction processing tasks, like recording visits instead of hits, or consolidating log records. Because the SIEM product does not perform these data reduction tasks, there may be more SIEM entries than records in the Log

Database.

Note: Information provided here is based on an original Websense Web Security support document available at https://www.websense.com/content/support/library/web/v80/triton_ web_help/settings_siem_explain.aspx

. For more detailed information about the data passed to the SIEM integrations, refer to the document "Integrating web protection solutions with thirdparty SIEM products" available at the following location: http://www.websense.com/content/support/library/web/v80/siem/siem.pdf#page=22 .

Subsections of this document provide mapping information for category numbers, disposition codes, reason strings, and other information included in the SIEM output.

Plugin Enablement

For plugin enablement information, see

421 USM Anywhere™ Deployment Guide

Supported Plugins

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l bytes_in l bytes_out l content_category l customfield_1 l customfield_2 l destination_address l destination_hostname l destination_port l destination_username l duration l event_action l event_description l event_name l event_severity l policy l rep_device_model l rep_device_vendor l rep_device_version l request_content_type l request_http_version l request_method l request_url l request_user_agent l response_code l source_address l source_hostname l source_port

Additional Resources and Troubleshooting

For troubleshooting, see the vendor documentation.

USM Anywhere™ Deployment Guide 422

Supported Plugins

zScaler NSS

When you configure zScaler Nanalog Streaming Service (NSS) to send log data to USM Anywhere, you can use the zScaler NSS plugin to translate the raw log data into normalized events for analysis.

Device

Vendor

Device Type

Connection Type

Details zScaler

Proxy

Syslog

Integrating zScaler NSS

Before you configure the zScaler Nanalog Streaming Service (NSS) integration, you must have the

IP Address of the USM Anywhere Sensor.

To configure zScaler NSS to send log data over syslog to USM Anywhere

1. Log in to the administration portal for Zscaler NSS.

2. In the navigation pane, select Administration > Settings > Nanolog Streaming Service.

3. From the NSS Feeds tab, click Add.

4. In the Feed Name field, enter a name for the NSS feed.

5. From the NSS Server list, select the ZScaler NSS system.

6. From the Status list, select Enabled.

7. In the SIEM IP Address field, enter the IP address of the USM Anywhere Sensor.

8. Click Save.

Plugin Enablement

For plugin enablement information, see

Configuring VMware ESX Virtual Switches for Port Monitoring

Available Plugin Fields

The following plugin fields are important attributes extracted from the syslog message. USM

Anywhere reports use these fields, and you can also reference them when creating custom reports.

In addition to reporting, the USM Anywhere correlation rules make use of these fields.

l access_control_outcome l app_name l app_type l bytes_in

423 USM Anywhere™ Deployment Guide

l bytes_out l content_category l customfield_0 l customfield_1 l destination_address l event_name l malware_family l malware_variant l reputation_score l request_method l request_referrer l request_url l request_user_agent l response_code l source_address l source_username l timestamp_occured l timestamp_received l transport_protocol

Troubleshooting

For troubleshooting, refer to the vendor documentation: https://help.zscaler.com/zia/about-nanolog-streaming-service https://help.zscaler.com/zia/troubleshooting-nss

Supported Plugins

USM Anywhere™ Deployment Guide 424

Device Port Mirroring Configuration

USM Anywhere supports use of a number of devices for the purpose of port mirroring.

By configuring a mirror port in your device, you can clone all traffic to a single port. To do this, the switch sends a copy of all network packets seen on one port (or an entire VLAN) to another port.

USM Anywhere immediately starts receiving events from the device through the port and starts analysis on them.

This chapter includes the following topics to provide detailed information about port mirroring on a number of devices:

About Port Mirroring

Configuring a Hyper-V Virtual Machine for Port Mirroring on a Windows Server 2012+

Configuring the ADTRAN (AOS) Switch for Port Mirroring

Configuring the Check Point Gateway for Port Mirroring

Configuring the Cisco ASA 5505 for Port Mirroring

Configuring the Cisco Nexus for Port Mirroring

Configuring the Cisco SGxxx Series for Port Mirroring

Configuring the Dell Networking Force10 Switch for Port Mirroring

Configuring the Fortinet-FortiGate Switch for Port Mirroring

Configuring SonicWALL Port Mirroring

USM Anywhere™ Deployment Guide 425

About Port Mirroring

USM Anywhere supports use of a number of devices for the purpose of port mirroring.

USM Anywhere immediately starts receiving events from the device through the port and starts analysis on them.

Configuring VMware ESX Virtual Switches for Port Monitoring

VMware ESX Virtual Switch terminology equates the term

SPAN with port mirroring.

Creating the vSwitch SPAN Port Group

Granting Promiscuous Mode Permissions to the Port Group

Assigning USM Anywhere Interfaces to the Port Group

Creating the vSwitch SPAN Port Group

To create the vSwitch SPAN port group

1. Open ESX vSphere GUI.

2. Click the Configuration tab.

3. Select Networking from the side panel, and then Properties.

426 USM Anywhere™ Deployment Guide

Configuring VMware ESX Virtual Switches for Port Monitoring

4. Add a new Virtual Machines port group to the existing switch.

Name the port group to indicate its visibility to all traffic (SPAN port) l

VLAN ID 'ALL (4095)' is a special ID in VMware vSwitch that has visibility to all traffic on the switch

USM Anywhere™ Deployment Guide 427

Configuring VMware ESX Virtual Switches for Port Monitoring

428

The SPAN port creates. Any VM interface connected to this SPAN port group is able to enter promiscuous mode and capture traffic from any other VM interface connected to the other port groups on this vSwitch.

USM Anywhere™ Deployment Guide

Configuring VMware ESX Virtual Switches for Port Monitoring

Granting Promiscuous Mode Permissions to the Port Group

To grant promiscuous mode permissions to the port group

1. Open ESX vSphere GUI.

2. Click Configuration tab.

3. Select Networking from the side panel, and then Properties.

4. Check the port group has permission for interfaces to enter promiscuous mode.

USM Anywhere™ Deployment Guide 429

Configuring VMware ESX Virtual Switches for Port Monitoring

5. (Optional) If the defaults are to deny promiscuous mode, open the properties sheet (click Edit) for the SPAN port group and manually assign permission for promiscuous mode.

Assigning USM Anywhere Interfaces to the Port Group

To assign USM Anywhere interfaces to the port group

1. Edit settings of the target virtual appliance.

430

2. Assign the network adapter to the created port mirroring groups (SPAN port), and use network

USM Anywhere™ Deployment Guide

Configuring VMware ESX Virtual Switches for Port Monitoring adapters 3, 4, 5, and 6 for port mirroring the AlienVault USM Anywhere appliance..

Note: Interfaces are pre-configured in the system.

USM Anywhere™ Deployment Guide 431

Configuring a Hyper-V Virtual Machine for Port Mirroring on a Windows Server 2012+

Configuring a Hyper-V Virtual Machine for Port Mirroring on a

Windows Server 2012+

The following procedures work natively on Windows Server 2012 R2 Hyper-V Hosts. Windows

Server 2012 requires a hotfix .

Configuration for port mirroring consists of two tasks: l

Configuring the Virtual Machine to Capture Mirrored Traffic

Configuring the Mirror Port

Configuring the Virtual Machine to Capture Mirrored Traffic

To configure the virtual machine you want to use to capture mirrored traffic

1. Open the Hyper-V Manager and right-click the machine that you want to use to capture mirrored traffic.

2. Select Settings.

3. Expand the associated network adapter and select Advanced Features.

4. Under the Port Mirroring section, select the mirroring mode, then set it to Destination.

432

5. Click Apply and OK.

USM Anywhere™ Deployment Guide

Configuring a Hyper-V Virtual Machine for Port Mirroring on a Windows Server 2012+

Configuring the Mirror Port

To configure the mirror port

1. Start a Windows PowerShell console.

2. Enter:

$a = Get-VMSystemSwitchExtensionPortFeature -FeatureId 776e0ba7-94a1-41c8-

8f28-951f524251b5

$a.SettingData.MonitorMode = 2 add-VMSwitchExtensionPortFeature -ExternalPort -SwitchName <virtual_ switch_name> -VMSwitchExtensionFeature $a

Important: Be aware that, if you enable promiscuous mode in a physical port, it directs all the traffic received on that port towards the virtual machine destination.

To learn more about configuring port mirroring on a Hyper-V Virtual Machine, visit this web page .

USM Anywhere™ Deployment Guide 433

Configuring the ADTRAN (AOS) Switch for Port Mirroring

This procedure explains how to configure the ADTRAN (AOS) Switch for port mirroring through both the switch CLI and the switch web UI.

Configuration Through the CLI

To configure the device through the CLI

1. Open a monitor session.

2. Specify which port to mirror (the source port):

(config)#monitor session 1 source interface ethernet 0/<source_port>

3. Specify which port is going to mirror the traffic (the destination port):

(config)#monitor session 1 destination interface ethernet 0/<destination_ port>

Note: There can only be one monitor session, therefore, the only available monitor session is

"1."

4. Verify the configuration of the mirrored ports:

Switch#show monitor session all

Configuration Through the Web UI

To configure the device in the web UI

1. Navigate to Utilities > Port Mirroring.

2. Choose Destination Port.

3. Select the proper port from this menu.

4. Select No-Tag option to not to tag VLAN traffic if needed.

5. Select the source port to mirror from the Source Port drop down menu.

6. Click Add.

Note: If you want to add additional source ports to monitor, select another port from the

Source Port drop down menu and click Add.

7. In the CLI,

verify the configuration of the mirrored ports .

To learn more about configuring port mirroring on ADTRAN (AOS) switches, see Configuring Port

Mirroring on AOS.pdf on https://supportforums.adtran.com/servlet/JiveServlet/previewBody/2291-

102-2-8423 .

434 USM Anywhere™ Deployment Guide

Configuring the Check Point Gateway for Port Mirroring

This procedure explains how to configure a Check Point Gateway Switch for port mirroring through its CLI and web UI.

Connecting the Device

To configure the device

1. Open the VMware Security Gateway.

2. Enter the following in the command line: sysconfig

3. Select Network Connections.

4. Select Configure Connections.

5. Select the interface to configure as mirror-port.

This is the one that you connected.

6. Select Define as connected to a mirror port.

7. Enable the Application Control blade in the SmartDashboard.

You can also enable the IPS blade to see IPS traffic.

Note: If you only want to enable the IPS blade, you must activate at least one HTTP protection.

8. Install the Policy.

Verifying the Configuration

To verify the configuration

1. Browse to an internet site, such as Google.

2. Open SmartView Tracker.

3. Verify that you see traffic from the blade you enabled.

To learn more about configuring a mirror port on a Check Point gateway, visit the Check Point website at https://sc1.checkpoint.com/documents/R76/CP_R76_AppControl_

WebAdmin/64821.htm

USM Anywhere™ Deployment Guide 435

Configuring the Cisco ASA 5505 for Port Mirroring

To configure the device

1. Open a monitoring session.

2. Configure the interface:

#interface <port>

3. Specify the destination port:

#switchport monitor<destination_port>

4. Specify the source port:

#switchport monitor<source_port>

To learn more about configuring port mirroring in the Cisco ASA 5505 device, visit the vendor website at http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/configuration/guide/conf_ gd/int5505.html#wp1067336 .

436 USM Anywhere™ Deployment Guide

Configuring the Cisco Nexus for Port Mirroring

To configure the device

1. Open a monitor session.

2. Enter global configuration mode:

#configure terminal

3. Enter interface configuration mode for the specified Ethernet interface selected by the port values:

#interface ethernet [port]

4. Set the interface to monitor mode. Priority flow control is disabled when the port is configured as a SPAN destination:

#switchport monitor

5. Revert the global configuration mode:

#exit

6. Enter monitor configuration mode:

#monitor session [session-number]

7. Configure the Ethernet destination port:

#destination interface ethernet [port]

To learn more about configuring port mirroring with the Cisco Nexus device, see the vendor website at http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/C

LIConfigurationGuide/Span.htm

USM Anywhere™ Deployment Guide 437

Configuring the Cisco SGxxx Series for Port Mirroring

To configure port and VLAN mirroring

1. Select Administration > Diagnostics > Port and VLAN Mirroring.

2. If your switch supports RSPAN: l

RSPAN VLAN. Select Enable to enable RSLAN VLAN mirroring.

RSPAN VLAN ID. Select the VLAN to be mirrored.

Note: When you configure a RSPAN mirroring session, you should select this VLAN as the RSPAN VLAN.

3. Click Add to add a SPAN or RSPAN mirroring session.

4. Enter the following information: l

Session ID. Select the identifier for the mirroring session.

Session Type. Select one of the following options: o

Local Port Based. Copies Tx, Rx, or both Tx and Rx traffic from each port to the destination port.

Local VLAN Based. Copies traffic from the local VLAN to the destination port.

RSPAN Source Session. Uses a VLAN to copy traffic from a source port or a source

VLAN to another device.

RSPAN Destination Session. Uses a VLAN to copy traffic from a destination port to another device.

5. If Local Port Based is selected, indicate the following: l

Destination Port. Select the analyzer port to which you want packets copied.

A network analyzer, such as a PC running Wireshark, is connected to this port.

Note: Any port identified as an analyzer destination remains such until all the entries have been removed.

Allow Ingress Packets. Select Enable to allow the destination port to receive uncopied ingress packets.

Source Port. Select the source ports from where traffic is mirrored and select the type of traffic to be mirrored to the analyzer port. The options are: o

Rx Only. Port mirroring on incoming packets.

Tx Only. Port mirroring on outgoing packets.

Tx and Rx. Port mirroring on both incoming and outgoing packets.

N/A. Traffic from this port is not mirrored.

438 USM Anywhere™ Deployment Guide

Configuring the Cisco SGxxx Series for Port Mirroring

6. If Local VLAN Based is selected, type the following information: l

Destination Port. Select the analyzer port to where packets are copied.

Allow Ingress Packets. Check Enable to allow the destination port to receive ingress packets that are not copied.

VLAN. Select the source VLAN from where traffic is mirrored.

7. If RSPAN Source Session is selected, type the following information: l

RSPAN VLAN. Select the VLAN to be used to copy traffic to another device. This VLAN should be same as the VLAN defined in the RSPAN VLAN ID field.

Reflector Port. Select the port or LAG to be connected to another device.

Source Type. Select Port or VLAN as the source port or source VLAN.

If Port is selected, select the source ports from where traffic is mirrored and select the type of traffic to be mirrored to the analyzer port. The options are: o

Rx Only. Port mirroring on incoming packets.

Tx Only. Port mirroring on outgoing packets.

Tx and Rx. Port mirroring on both incoming and outgoing packets.

N/A. Traffic from this port is not mirrored.

If VLAN is selected, select a source VLAN from where traffic is mirrored.

VLAN. Select a VLAN as the source VLAN.

8. If RSPAN Destination Session is selected, type the following information: l

RSPAN VLAN. Select the VLAN to be used to copy traffic to another device. This VLAN should be same as the VLAN defined in the RSPAN VLAN ID field.

Destination Port. Select the analyzer port to where packets are copied.

Allow Ingress Packets. Check Enable to allow the destination port to receive ingress packets that are not copied.

9. Click Apply.

This updates the running configuration.

To learn more about configuring port mirroring on the Cisco SGxxx Series devices, visit the vendor website at https://www.cisco.com/assets/sol/sb/SG220_Emulators/SG220_Emulator_v1-0-0-18_

20140626/home.html

USM Anywhere™ Deployment Guide 439

Configuring the Dell Networking Force10 Switch for Port Mirroring

To configure the device

1. Enter configuration mode.

#configure

2. Enter the destination port to use for the monitoring session, and confirm that it has no configuration:

#interface te 0/2

3. Remove any IP addresses that may have previously been configured:

#no ip address

4. Enable the port:

#no shutdown

5. Exit the destination port interface:

#exit

6. Set up and identify the session number (range is from 0 - 65535):

#monitor session 0

7. Configure the source, the port you want to monitor, the destination port you want to send the monitored packets to, and the direction (

Both/Rx/Tx)

#source te 0/1 destination te 0/2 direction both

8. Verify port monitoring is active:

#show monitor session 0

To learn more about configuring port mirroring on the Dell Networking Force10 Switch, visit the vendor website at http://www.dell.com/support/article/us/en/04/HOW10532 .

440 USM Anywhere™ Deployment Guide

Configuring the Fortinet-FortiGate Switch for Port Mirroring

This procedure explains how to configure Fortinet-FortiGate Switches for port mirroring on models with built-in hardware switches (for example, the FortiGate-100D, 140D, and 200D), using the

Switch Port Analyzer (SPAN) feature.

Configuration Through the CLI

To configure SPAN through the CLI

Enter: config system virtual-switch edit <port> set span enable set span-source-port <port> set span-dest-port <port> set span-direction {both | Tx | Rx} end end

Configuration Through the Web UI

To configure SPAN through the web UI

1. Go to System > Network > Interfaces.

2. Edit a hardware switch interface.

By default, the system may have a hardware switch interface called a LAN. You can also create a new hardware switch interface: a. Select the SPAN check box, then select a source port from which you want traffic mirrored.

b. Select one of the following: l

Traffic received l

Traffic sent l

Both

To learn more about configuring port mirroring on Fortinet-FortiGate Switches, visit the vendor website at http://kb.fortinet.com/kb/documentLink.do?externalID=FD36798 .

USM Anywhere™ Deployment Guide 441

Configuring SonicWALL Port Mirroring

You can configure port mirroring on the Dell SonicWALL NSA 2400MX to send a copy of network packets seen on one or more switch ports (or on a VLAN) to another switch port, called the mirror port. By connecting to the mirror port, you can monitor the traffic passing through the mirrored port

(s).

Note: A VLAN trunk port can be mirrored, but cannot act as a mirror port itself.

To create a new port mirroring group

1. Navigate to Switching > Port Mirroring.

2. Click New Group.

3. In the Edit Mirror Group dialog box, type a descriptive name for the group into the Interface

Group Name field.

4. For the Direction, select one of the following: l ingress — Monitors traffic arriving on the mirrored port(s).

l egress — Monitors traffic being sent from the mirrored port(s).

l both — Monitors traffic in both directions on the mirrored port(s).

5. In the All Interfaces list, select the port to mirror the traffic to and click the top right-arrow button to move it to the Mirror Port field. You must use an unassigned port as the mirror port.

6. In the All Interfaces list, select one or more ports to be monitored, and click the lower rightarrow button to move them to the Mirrored Ports field. You will be able to monitor traffic on the mirrored port(s) by connecting to the mirror port.

7. To enable port mirroring for these ports, select the Enable checkbox.

8. Click OK.

To learn more about configuring port mirroring on SonicWall devices, visit the vendor website at https://support.sonicwall.com/kb/sw12079 .

442 USM Anywhere™ Deployment Guide

USM Anywhere AlienApp Configuration

AlienVault® AlienApps™ extend the threat detection and security orchestration capabilities of the

USM Anywhere platform to other security tools that your IT team uses, providing a consolidated approach to threat detection and response. With AlienApps, you can monitor more of your security posture directly within USM Anywhere, including your cloud services like Office 365 and G Suite.

AlienApps also enable you to automate and orchestrate response actions in security tools from vendors such as Cisco and Palo Alto Networks, greatly simplifying and accelerating the threat detection and incident response processes.

AlienApps are different from plugins. Plugins have a singular function to translate raw log data into normalized events for analysis by USM Anywhere, but AlienApps do much more, including collecting and enriching log data, performing threat analysis, and providing workflow that coordinates response actions with the infrastructure and third-party applications to provide security orchestration.

This chapter includes the following topics:

About USM Anywhere AlienApps

Configuring the AlienApp for Carbon Black

Configuring the AlienApp for Cisco Umbrella

Configuring the AlienApp for G Suite

Configuring the AlienApp for McAfee EPO

Configuring the AlienApp for Office 365

Configuring the AlienApp for Okta

Configuring the AlienApp for Palo Alto Networks

Configuring the AlienApp for ServiceNow

Configuring the AlienApp for Dark Web Monitoring

USM Anywhere™ Deployment Guide 443

About USM Anywhere AlienApps

AlienApps™ extend the capabilities of USM Anywhere through integrations with leading security tools, most specifically in the following areas: l

Data extraction l

Correlation of data to produce events and alarms l

Special AlienApp data dashboards that help you visualize your environment and alert you to issues originating from a particular data source

You can then explore these in more depth in USM Anywhere's Event Details or Alarm Details pages.

Orchestration ability that enables you to automate your security operations in a variety of ways

For example, if USM Anywhere finds data associated with a malicious website, orchestration rules might stipulate that this information be sent to a third-party database an external product.

Configuring the AlienApp for Carbon Black

The AlienApp™ for Carbon Black enhances the threat detection capabilities of USM Anywhere by collecting and analyzing log data from your Carbon Black Cb Response and Cb Protection applications and provides orchestration actions to streamline incident response activities. Carbon

Black is a recognized leader in next-generation endpoint security, and its Cb Endpoint Security

Platform includes the following products: l

Cb Defense (next-generation antivirus) l

Cb Response (incident response and threat hunting) l

Cb Protection (application control)

When the AlienApp for Carbon Black is enabled with a successful connection, it supports two actions within USM Anywhere: l

Isolate hosts from an alarm l

Isolate hosts from an orchestration rule

Upon launch of the action, it sends a request to Cb Response to isolate the specified endpoint. For information about launching these actions and defining these orchestration rules for the AlienApp, see Creating an Orchestration Rule for the AlienApp for Carbon Black in the USM Anywhere User

Guide.

You can combine the AlienApp for Carbon Black with the Carbon Black data plugins to enhance the threat detection capabilities of USM Anywhere by collecting and analyzing log data from

Carbon

Black Cb Response

and

Carbon Black Cb Protection

and implementing orchestration actions to streamline incident response activities.

444 USM Anywhere™ Deployment Guide

Configuring the AlienApp for Carbon Black

Generating a Carbon Black API Token

Before you can use the Carbon Black orchestration actions within USM Anywhere, you must have an API token that USM Anywhere can use to connect to your Carbon Black server. Carbon Black generates this token for use by your user account.

Important: You must have global administrator privileges to generate a valid API token for integration with the AlienApp for Carbon Black.

To acquire the Carbon Black API token

1. Open your Carbon Black dashboard with your user login.

2. Click your user name in the top-right corner and select My Profile.

3. On the left navigation for the page, click API Token.

This displays the API token page and generates a unique token that is displayed in the text box.

Each user receives their own, unique API token. This token has the same power and privileges attached to your user account and does not expire.

USM Anywhere™ Deployment Guide 445

Configuring the AlienApp for Carbon Black

Note: If you generate a new token at some point in the future by clicking the Reset API

Token button, this will revoke the existing token and you must also update the settings for the AlienApp for Carbon Black in USM Anywhere.

4. Copy the token text to your clipboard or a secured text file.

Enabling the AlienApp for Carbon Black API Connection

After you generate a Carbon Black API token and copy the value, you're ready to enable the

AlienApp for Carbon Black in USM Anywhere.

1. In USM Anywhere, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click Carbon Black.

The Status tab is displayed, but it does not provide status information until the AlienApp for

Carbon Black is enabled and configured.

3. Select the sensor that you want to use for the enabled AlienApp.

USM Anywhere AlienApps operate through a deployed sensor and use APIs to integrate with the connected third-party technology. If you have more than one deployed sensor, choose the sensor that can access the integration endpoint.

446

4. Click Enable.

5. Select the Settings tab.

6. Enter the connection information to access the API for your Carbon Black environment: l

Server address or hostname — Enter the IP address or hostname of your Carbon Black server.

API token — Click Change API token and enter the API token value that you copied in the

Carbon Black console.

CA certificate (Optional) — Add the security certificate that establishes a trusted SSL between the Carbon Black server and USM Anywhere.

Select the Require CA certificate checkbox if you want to use a security certificate.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for Cisco Umbrella

7. Click Save.

8. Select the Status tab to verify the connection.

An icon indicates that there is a problem with the connection. The MESSAGE column provides information about the issue. If this is the case, repeat the steps to fix the configuration or troubleshoot your Carbon Black connection.

Configuring the AlienApp for Cisco Umbrella

Cisco Umbrella (formerly known as OpenDNS) is a cloud-delivered secure internet gateway that stops current and emergent threats over all ports and protocols. It blocks access to malicious domains, URLs, IPs, and files before a connection is established or a file is downloaded. The

AlienApp™ for Cisco Umbrella provides functional support to easily ingest data from Cisco Umbrella to USM Anywhere for analysis and also enable orchestration for triggering actions within Cisco

Umbrella based on risk identified from USM Anywhere.

Note: To fully integrate USM Anywhere with your Cisco Umbrella implementation, you should also have the Cisco Umbrella plugin enabled so that USM Anywhere can retrieve and normalize raw log data from Cisco Umbrella. Raw log data retrieval from Cisco Umbrella requires a deployed AWS Sensor. The combination of the Cisco Umbrella plugin and the

AlienApp for Cisco Umbrella provides a full scope of data and analysis within USM Anywhere.

For information about enabling this plugin and raw log data retrieval, see

Cisco Umbrella

When the AlienApp for Cisco Umbrella is enabled and configured, you create orchestration rules to send data from USM Anywhere to Cisco Umbrella. For example, you might create a rule where

USM Anywhere automatically sends the URLs of suspicious domains that it identifies to Cisco

Umbrella. For information about adding these types of orchestration rules for the AlienApp, see

Creating an Orchestration Rule for Cisco Umbrella AlienApp™ in the

USM Anywhere User Guide.

USM Anywhere™ Deployment Guide 447

Configuring the AlienApp for Cisco Umbrella

Creating a Cisco Umbrella Integration

Before you can use the Cisco Umbrella orchestration actions within the USM Anywhere web UI, you must establish an integration point in Cisco Umbrella to be used by USM Anywhere. AlienVault integration is only included in the Umbrella Platform Package.

To set up an integration in Cisco Umbrella

1. Open your Cisco Umbrella Dashboard and go to Settings > Integrations.

2. Click the Add icon (+).

3. Add a name for the custom integration, and click Create.

4. Click the new custom integration to expand it and display the details.

5. Select Enable.

6. Copy the customer key value displayed in the integration URL.

7. Click Save.

Enabling the AlienApp for Cisco Umbrella

After you create the Cisco Umbrella integration and copy the key value, you're ready to enable the

AlienApp for Cisco Umbrella in USM Anywhere.

To enable the AlienApp for Cisco Umbrella

1. In the USM Anywhere web UI, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click Cisco Umbrella.

The Status tab is displayed, but it does not provide status information until the AlienApp for

Cisco Umbrella is enabled and configured.

3. Select the sensor that you want to use for the enabled AlienApp.

448

4. Click Enable.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for G Suite

5. Select the Credentials tab.

6. Paste the customerKey value you copied in the previous task into the Customer Key field.

7. Click Save Credentials.

8. Select the Status tab to verify the connection.

Configuring the AlienApp for G Suite

With the AlienApp™ for G Suite, you can monitor your Google G Suite (formerly known as Google

Apps) activity and detect threats directly from USM Anywhere — giving you a single pane of glass for all your security monitoring, compliance, and orchestration needs. The AlienApp for G Suite collects and analyzes your G Suite events to enable security analysis of your user and admin activities, extending USM Anywhere threat detection capabilities to Gmail, Google Calendar, and Google

Drive (Docs, Sheets, Slides, and Forms). The out-of-the-box correlation rules for G Suite events enable USM Anywhere to automatically create alarms, notifying you about suspicious activity in your environment.

After you configure the connection between the AlienApp for G Suite for a deployed USM Anywhere sensor and your G Suite environment, the predefined log collection jobs perform scheduled scans for events. When the first of these events are collected and analyzed, the G Suite dashboards are available in the DASHBOARDS menu (according the type of events that USM Anywhere collects).

USM Anywhere™ Deployment Guide 449

Configuring the AlienApp for G Suite

Setting Up the Google Service Account

As a Google administrator, you must create a new project in your Google Developers console and create a service account in the API Console to support server-to-server interactions. Credentials for a service account include a generated email address that is unique and at least one public/private key pair. When domain-wide delegation is enabled, a client ID is also part of these credentials. For more information about server-to-server authentication in Google, refer to https://developers.google.com/accounts/docs/OAuth2ServiceAccount .

As you complete the following set up task, you must collect these items to complete the integration with the AlienApp for G Suite: l

Client ID for the service account l

User Email l

Private key file, which you download from Google when you create the service account

Important: You must have administrative privileges to configure G Suite for integration with the

AlienApp for G Suite. Ask your Google administrator for these privileges.

To set up the G Suite service account

1. Go to the Google Developers Console and sign into your account.

2. Click Select a project and then click the + button in the Select dialog.

3. Enter the Project name, accept the terms of service and click Create.

4. Click the menu ( ) icon and select IAM & Admin.

5. Click the Service accounts tab, and then click Create Service Account.

6. Enter a Service account name and choose the Project > Owner Role.

The dialog generates the Service account ID.

7. Select the Furnish a new private key option, choose P12.

450 USM Anywhere™ Deployment Guide

Configuring the AlienApp for G Suite

8. Select the Enable G Suite Domain-wide Delegation option and enter the integration product name.

9. Click CREATE.

A prompt instructs you to either open or save the P12 file, along with a second dialog showing the password for the private key assigned to your project.

10. Select SAVE FILE, then click OK.

11. In the New private key dialog, copy the password for the private key to a text file and click

CLOSE.

12. Under the Options column, click VIEW CLIENT ID and copy it to the same text file.

13. Open a new web browser window, access the Google Admin console, and enter your user credentials.

14. Click Security>Show More and select Advanced settings from the list of options.

15. In the Authentication section, select Manage API client access.

16. Paste the service account Client ID that you copied into the Client Name field.

USM Anywhere™ Deployment Guide 451

Configuring the AlienApp for G Suite

452

17. Enter https://www.googleapis.com/auth/admin.reports.audit.readonly

in the One or More API Scopes field.

18. Service Account and Scopes Propagation Time Similarly with the Service account and APIs, adding the Client and Scopes in the G Suite console may be subject to a propagation time of upto two hours. Check Connections for your G Suite platform in CloudMigrator may not be successful immediately.

19. Click Authorize.

Enabling the G Suite Admin SDK

Before you connect the AlienApp for G Suite to your new service account, make sure that Enable

API access is selected in your project. You must be signed in as an owner of the project or super admin for this task.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for G Suite

1. Go to the Setup Tool .

2. Click Select your project, select the project you created, and then click Continue.

The system informs you that the API was enabled.

3. In the API Manager Dashboard, check to see if Admin SDK appears and if it is enabled.

If not, click the Google APIs tab and search for Admin SDK. Select it and then click Enable.

Connecting the AlienApp for G Suite

After you create the new service account in G Suite and enable the Admin SDK, you must configure the connection within USM Anywhere.

Important: Adding the Client and Scopes in the G Suite console can be subject to a propagation time, which can be up to two hours. The AlienApp for G Suite connection configuration might not be successful immediately if these resources are not yet accessible.

To enable the AlienApp for G Suite

1. In the USM Anywhere web UI, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click Google G Suite.

3. Select the sensor that you want to use for the enabled AlienApp.

USM Anywhere™ Deployment Guide 453

Configuring the AlienApp for McAfee EPO

4. Select the Credentials tab.

5. Enter the Service Client IDand your G Suite User Email.

454

6. In the Private Key field, click Choose File select the downloaded P12 private key file for the

Google service account you created.

7. Click Save Credentials.

Configuring the AlienApp for McAfee EPO

The AlienApp™ for McAfee EPO provides functional support to connect to the ePO server SQL database and retrieve and ingest data to USM Anywhere for analysis. After the initial collection and analysis of this event data, the DASHBOARDS list includes the McAfee ePO dashboard, which summarizes events from ePO so that you see what's going on at a glance.

To configure the AlienApp for McAfee EPO to perform this function, you must enable the AlienApp and add a job in USM Anywhere. Before you do this, make sure that you have the following information: l

Hostname or IP address of the ePO server SQL database l

Port number (usually 1433) l

The ePO Server SQL database name l

Username and password you use to log into the ePO server SQL database

To schedule a McAfee ePO job

1. In the USM Anywhere web UI, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click McAfee ePO.

3. Select the sensor that you want to use for the enabled AlienApp.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for McAfee EPO

4. Click the Actions tab.

5. On the right side of the page, click Schedule Job.

This opens the Schedule New Job dialog with many of the options already defined for an

AlienApp for McAfee EPO job.

6. Enter the Name and Description for the job.

The description is optional, but it is a best practice to provide this information so that others can easily understand what it does.

USM Anywhere™ Deployment Guide 455

Configuring the AlienApp for McAfee EPO

456

7. Enter the McAfee ePO database connection information: l

In the IP address field, enter the IP address of the ePO server SQL database.

In the Port number field, enter the port number on which the ePO server SQL database listens.

In the Database name field, enter the name of the ePO server SQL database.

In the Username and Password fields, enter the credentials you use to access the ePO server SQL database.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for McAfee EPO

8. Set the Schedule to specify when USM Anywhere runs the job.

First, choose the increment as Hour, Day, Week, Month, or Year. Next, set the interval options for the increment. The selected increment determines the available options.

For example, on a weekly increment you can select the days of the week to run the job.

Or, on a monthly increment you can specify a specific date or a day of the week that occurs within in the month.

USM Anywhere™ Deployment Guide 457

Configuring the AlienApp for Office 365

458

To finish, set the Start time. This is the time that the job starts at the specified interval. It uses the time zone configured for your USM Anywhere instance (default is UTC).

9. Click Save.

After the scheduled job runs, you should start seeing new events in USM Anywhere originating from the ePO Server SQL database.

Configuring the AlienApp for Office 365

With the AlienApp for Office 365, you can monitor all of your Office 365 cloud applications, track user activity, and receive alerts in USM Anywhere for suspicious and malicious activity in your environment. This integration gives you the ability to collect additional information about your environment and what your users are doing, which drives investigation and incident response processes: l

The out-of-the-box correlation rules for Office 365 events provided by the AlienApp for Office 365 enable USM Anywhere to automatically create alarms, notifying you about suspicious activity in your environment.

The AlienApp for Office 365 includes predefined dashboards that give an overview of OneDrive,

SharePoint, and Azure Active Directory activity and provide quick visibility into Office 365 activity and events to streamline your investigation and incident response processes.

Direct access to the Microsoft Office 365 Management Activity API provided by the AlienApp for

Office 365 gives you comprehensive visibility, a richer data set, and greater control over your cloud security, including information about your user, administration, system, and policy actions and events from Office 365 and Azure Active Directory (AD) activity logs.

Important: If you're a Windows user and would like to include Office 365 logs in your project, but don’t yet use Azure, you’ll need to sign up for an Azure subscription. The subscription is required to connect to the APIs that access your Office 365 environment.

It is not required that you deploy the USM Anywhere Azure sensor to use the AlienApp for

Office 365. You can use any deployed sensor for the AlienApp connection.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for Office 365

After you configure the connection between the AlienApp for Office 365 and the Microsoft Office 365

Management Activity API for a deployed USM Anywhere sensor, the predefined log collection job performs a scan for the events. When the first of these events are collected and analyzed, the Office

365 dashboards are available in the DASHBOARDS menu (according the type of events that USM

Anywhere collects).

Creating the Office 365 API App

The Office 365 Management Activity API provides information about various user, admin, system, and policy actions and events from Office 365. Within an Azure subscription, you define a new app for the Microsoft Office 365 Management Activity API communication with USM Anywhere. Before you create this app, you must have the following: l

Office 365 subscription from Microsoft l

Azure subscription l

Administrator credentials for the Azure tenant

To set up the app for the Office 365 API

1. Access Active Directory in the Azure portal: https://portal.azure.com/#blade/Microsoft_AAD_

IAM/ActiveDirectoryMenuBlade/Overview .

2. Navigate to App registrations and click New application registration.

3. Define a new app using the Web App / API Application type and click the Create button.

USM Anywhere™ Deployment Guide 459

Configuring the AlienApp for Office 365

460

4. In the App registrations list, select the app you just created.

5. From Settings, click Properties.

6. At the bottom of the Properties blade, toggle Multi-tenanted to Yes, and then click Save.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for Office 365

7. Within the Settings blade on the same page, select Required Permissions and click Add.

8. Click Select an API, select Office 365 Management APIs, and then click the Select button.

USM Anywhere™ Deployment Guide 461

Configuring the AlienApp for Office 365

9. Select all of DELEGATED PERMISSIONS and the following options for APPLICATION

PERMISSIONS: l

Read DLP policy events including detected sensitive data.

Read activity data for your organization.

Read service health information for your organization.

462

10. Click the Select button and then the Done button to complete the API access settings.

11. Make sure to click Grant Permissions after you add the permissions.

If you don't, the app won't work and only administrators are able to execute this action.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for Office 365

12. Return to the App profile and click Manifest.

In the Edit manifest page, the

"keyCredentials" section does not contain a value. When you complete the next task, you will generate the credentials in USM Anywhere and then supply the information here.

Connecting the App to the AlienApp for Office 365

After you create the app for the Office 365 API and perform the initial configuration, you're ready to grab the manifest credentials from the AlienApp for Office 365 in USM Anywhere and connect the

API app.

To complete the connection to the AlienApp for Office 365

1. In the USM Anywhere web UI, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click Office 365.

3. Select the sensor that you want to use for the enabled AlienApp.

USM Anywhere™ Deployment Guide 463

Configuring the AlienApp for Office 365

4. Click the Status tab to display the Manifest Credentials JSON, similar to the following example:

464

5. Copy the entire JSON code block (including the opening and closing brackets) to your clipboard.

6. Return to the Edit Manifest page in the Azure web UI and paste it into the manifest within

"keyCredentials"

USM Anywhere™ Deployment Guide

Configuring the AlienApp for Office 365

7. In the app profile, copy the Application ID to a text file.

8. Go to Azure Active Directory > Properties and copy the Directory ID (Tenant ID), then paste it in the same text file.

USM Anywhere™ Deployment Guide 465

Configuring the AlienApp for Okta

9. Return to the Office 365 page in the USM Anywhere web UI and click the Credentials tab.

10. Enter the copied IDs in the Tenant ID and Application ID fields.

466

11. Click Save Credentials.

Configuring the AlienApp for Okta

The AlienApp™ for Okta enhances the threat detection capabilities of USM Anywhere by collecting and analyzing log data from Okta. Okta is the leading independent provider of identity for the enterprise. This integration gives you the ability to collect and view information about your Okta environment and what your users are doing: l

The AlienApp for Okta regularly queries the Okta API for information, such as authentication events, user profile updates, user state changes, application and group assignment, and Okta platform changes.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for Okta l

The out-of-the-box correlation rules for Okta events provided by the AlienApp for Okta enable

USM Anywhere to automatically create alarms, notifying you about suspicious activity in your

Okta environment.

The AlienApp for Okta includes a predefined dashboard that provides an overview of Okta activity so that you have quick visibility to streamline your investigation and incident response processes.

After you configure the connection between the AlienApp for Okta and the Okta API for a deployed

USM Anywhere Sensor, the predefined, scheduled job collects event logs from Okta every 20 minutes. When the first of these events are collected and analyzed, the Okta dashboard becomes available in the DASHBOARDS menu.

Creating an Okta API Token

Before you can collect and analyze Okta log data within USM Anywhere, you must have an

API token that USM Anywhere can use to connect to your Okta environment. Okta issues an API token for a specific user and all requests with that token act on behalf of that user.

Important: You must have Okta administrator privileges to generate a valid API token for integration with the AlienApp for Okta.

To acquire the Okta API token

1. Open your Okta administration dashboard with your user login.

2. Select Security > API.

3. At the top of the page, click Create Token.

4. In the dialog, enter a name for the token and click Create Token.

The name should indicate the intended use for the token, such as USM-Anywhere.

Okta generates the unique token and displays the value in the dialog.

USM Anywhere™ Deployment Guide 467

Configuring the AlienApp for Okta

5. Copy the Token value to your clipboard or an encrypted text file and click OK, got it.

The list in the page includes your new token.

468

Note: If you (or another administrator) revoke this token and create a new one, you must also update the settings for the AlienApp for Okta in USM Anywhere.

Enabling the AlienApp for Okta API Connection

After you generate an Okta API token and copy the value, you're ready to enable the AlienApp for

Okta in USM Anywhere.

1. In USM Anywhere, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click Okta.

The Status tab is displayed, but the status information indicates an error until the AlienApp for

Okta is configured.

3. Select the sensor that you want to use for the enabled AlienApp.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for Okta

4. Select the Settings tab.

5. Enter the connection information to access the API for your Okta environment: l

Okta URL — Enter the URL that you use to access your Okta environment.

Okta API Token — Click Change API token and enter the API token value that you copied when you created the token.

6. Click Save.

7. Select the Status tab to verify the connection.

USM Anywhere™ Deployment Guide 469

Configuring the AlienApp for Palo Alto Networks

The AlienApp™ for Palo Alto Networks provides a set of orchestration actions that you can use to quickly send IP addresses to the firewall as a response to threats identified by USM Anywhere. The

AlienApp for Palo Alto Networks adds tags by default in the Palo Alto Networks Pan-OS firewall.

Each such tag contains the source address, destination address, or the FQDN of the event or alarm used to launch the action or that triggered the orchestration rule.

When you combine the AlienApp for Palo Alto Networks with the

Palo Alto Networks Pan-OS data plugin , you can enhance the threat detection capabilities of USM Anywhere by collecting and

analyzing log data from the firewall and implementing orchestration actions to streamline incident response activities.

When the AlienApp for Palo Alto Networks is enabled with a successful connection, you can create an orchestration rule or initiate an action directly from an event or alarm. Upon launch of the action, it sends a request to the Palo Alto Networks Pan-OS to add one of the following identifiers (depending on how the rule is defined) to its Object database and to tag it: l

IPv4 address l

IPv6 address l

FQDN

If the specified tag does not already exist in Palo Alto, this action will also create the new tag. For more information, see Creating an Orchestration Rule for Palo Alto Networks AlienApp™ in the

USM

Anywhere User Guide.

AlienApp for Palo Alto Networks Requirements

Before you can begin configuration, you must have the following information from the Palo Alto

Networks Pan-OS and, if desired, from a Certificate Authority: l

An API key l

The IP address or hostname of the Palo Alto Networks Pan-OS l

(Optional) A Secure Socket Layer (SSL) certificate from a trusted Certificate Authority

To acquire the Palo Alto Networks Pan-OS API key l

Go to https://www.paloaltonetworks.com/documentation/71/pan-os/xml-api/get-started-withthe-pan-os-xml-api/get-your-api-key and follow the vendor instructions to generate the key.

You'll use this key to enable a connection between the Palo Alto Networks Pan-OS instance and the AlienApp for Palo Alto Networks.

470 USM Anywhere™ Deployment Guide

Configuring the AlienApp for Palo Alto Networks

Configuring the AlienApp for Palo Alto Networks Connection

To support the orchestration actions in USM Anywhere, you must configure a connection with the

Palo Alto Networks Pan-OS firewall. This connection enables the AlienApp to send a request to the

Palo Alto Networks Pan-OS.

Important: USM Anywhere can only communicate with one Palo Alto Networks Pan-OS instance per sensor. If you have multiple Palo Alto Networks Pan-OS instances in your network, we recommend that you contact AlienVault Technical Support for setup help.

To configure the connection between the firewall and the AlienApp

1. In the USM Anywhere web UI, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click Palo Alto Networks.

The Status tab is displayed, but it does not provide status information until the AlienApp is enabled.

3. Select the sensor that you want to use for the enabled AlienApp.

4. At the top-right of the page, click Enable.

5. Click the SETTINGS tab.

6. Enter the connection information in the following fields: l

IP address or hostname — IP address or hostname of your Palo Alto Networks Pan-OS l

CA certificate (Optional) — Security certificate that establishes a trusted SSL between the

Palo Alto Networks Pan-OS and USM Anywhere

Select the Require CA certificate checkbox if you want to use a security certificate.

USM Anywhere™ Deployment Guide 471

Configuring the AlienApp for ServiceNow l

API key — API key that you generated in the Palo Alto Networks Pan-OS

472

7. Click Save.

Configuring the AlienApp for ServiceNow

Using the AlienApp™ for ServiceNow, you can streamline incident response activities by automatically opening ServiceNow incident tickets in response to threats detected by

USM Anywhere. Upon execution of the action, USM Anywhere generates the ServiceNow incident ticket and passes the associated information to that ticket.

To enable these actions within USM Anywhere, you must configure the AlienApp for ServiceNow by setting up the integration with your ServiceNow instance. After this configuration is validated, users can include an action as part of an orchestration rule triggered by an Event, or launch the action from the details page for a specific Alarm or Vulnerability. For more information about using this functionality, see Creating an Orchestration Rule: AlienApp for ServiceNow in the USM Anywhere

User Guide.

AlienApp for ServiceNow Requirements

As a ServiceNow administrator, you must create the user account credentials in your ServiceNow instance to be used by the AlienApp. This user account must have rights to perform

CRUD operations using the ServiceNow Table and Aggregate REST APIs. If you choose to use

OAuth, you must have a client user setup in the System OAuth- Application Registry.

Important: It is a best practice to have a user account configured in your ServiceNow instance that can be used exclusively for USM Anywhere. With this exclusive user account, you can easily filter incidents in the ServiceNow web UI to display incident tickets created by

USM Anywhere. Also, the incidents created by the AlienApp for ServiceNow and the history

USM Anywhere™ Deployment Guide

Configuring the AlienApp for ServiceNow are displayed in the USM Anywhere UI according to this user name; by using an exclusive user account, this information will include only the information that is related to USM Anywhere

Alarm, Vulnerability, and Event response.

Before you configure the AlienApp for ServiceNow, make sure you have the following: l

Fully-qualified domain name (FQDN) for your ServiceNow instance l

User name and password to use for USM Anywhere access l

(OAuth only) ServiceNow Client ID l

(OAuth only) ServiceNow Client secret

Configuring the ServiceNow Connection in USM Anywhere

To support the orchestration actions in USM Anywhere, you must configure a connection with the

ServiceNow instance. This connection enables the AlienApp to perform CRUD operations using the

ServiceNow Table and Aggregate REST APIs.

To configure the connection

1. In the USM Anywhere web UI, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click ServiceNow.

The Status tab is displayed, but it does not provide status information until the AlienApp for

ServiceNow is enabled and configured.

3. Select the sensor that you want to use for the enabled AlienApp.

4. At the top right of the page, click Enable.

5. Select the SETTINGS tab.

6. Specify the basic connection information:

USM Anywhere™ Deployment Guide 473

Configuring the AlienApp for ServiceNow l

Instance name — Enter the FQDN for your ServiceNow instance.

For example, if you access your ServiceNow instance at https://mycorp.service-now.com, you must enter mycorp.service-now.com in this field.

Username — Enter the user name for the account that USM Anywhere will use to access ServiceNow.

Password — Enter the password for the account.

7. (OAuth only) Specify the OAuth authentication parameters: l

Is OAuth enabled? — Select this check box to use OAuth for the ServiceNow connection.

Client ID — Enter the client ID that is configured in the ServiceNow System OAuth Application Registry.

Client Secret — Enter the client secret for the client ID.

474

8. Click Save.

9. Select the STATUS tab to verify the connection.

After USM Anywhere completes a successful connection to the ServiceNow instance and the

APIs, this tab displays icons in the HEALTH column for the AlienApp.

USM Anywhere™ Deployment Guide

Configuring the AlienApp for ServiceNow

If you see a icon, this indicates that there is a problem with the connection. The MESSAGE column provides information about the issue. If this is the case, repeat the steps to fix the configuration or troubleshoot your ServiceNow connection.

Managing the USM Anywhere-Created Incidents

After the AlienApp for ServiceNow is configured and users execute the supported actions, you can easily view a list of the ServiceNow incidents created by USM Anywhere. This list includes all incidents created by an action applied directly to an Alarm or Vulnerability, as well as any from actions that were triggered from an orchestration rule. From this list, you can open the incident in your ServiceNow console to view additional information about the incident or make updates to the incident, such as assigning the item to a team member or changing the priority.

To access a ServiceNow incident

1. In the USM Anywhere web UI, go to SETTINGS > ALIENAPPS.

2. In the AlienApps page, click ServiceNow.

3. Select the INCIDENTS tab.

USM Anywhere™ Deployment Guide 475

Configuring the AlienApp for Dark Web Monitoring

The displayed list includes all ServiceNow incidents generated by USM Anywhere, with the most recently opened incidents at the top. Here you can view the current status and assignment for the incident as reported by your ServiceNow instance.

4. Click the View link to open the incident in the ServiceNow console.

This launches the ServiceNow web UI and loads the incident for easy viewing and updating.

476

Configuring the AlienApp for Dark Web Monitoring

The AlienApp™ for Dark Web Monitoring allows you to detect if your users’ credentials have been compromised in a third-party breach and trafficked on the dark web, so that you can take immediate action to prevent a breach. AlienVault provides this functionality at no additional cost through a partnership with SpyCloud, a pioneer in breach discovery. SpyCloud uses human and machine intelligence to monitor public, private, and covert sources on the dark web, identifying user credentials that have been stolen. This data is collected within USM Anywhere through the AlienApp for Dark Web Monitoring.

To enable this functionality within USM Anywhere, you must configure the AlienApp for Dark Web

Monitoring by setting up your watchlist. After this configuration is complete, the AlienApp for Dark

Web Monitoring queries the SpyCloud API every 24 hours for information regarding all verified watchlist items. It parses all collected data and displays it as Events and Alarms in the

USM Anywhere interface.

Events displayed in USM Anywhere include the following fields: l

Email address included in the breach l

Date the breach was reported by SpyCloud l

The type of breach (public or private source) l

The password type of the compromised credential

USM Anywhere™ Deployment Guide

Configuring the AlienApp for Dark Web Monitoring l

A flag if the event is the first time SpyCloud has detected the email/password combination in any breach l

A flag if the user of the email address has been infected

The AlienApp for Dark Web Monitoring supports a watchlist that includes one domain and/or a list of up to 10 email addresses. When combining both watchlist types, for example, you could add your company domain as well as a list of email addresses to expand the scope of monitoring to include personal accounts of top executives or other high-risk employees.

Important: Monitoring a domain requires verification of ownership by adding an automatically generated SpyCloud key to either the DNS record or a page on the domain web site.

Monitoring an individual email address requires the owner of the address to click a link in a verification email sent by USM Anywhere.

To configure the AlienApp for Dark Web Monitoring

1. In USM Anywhere, go to SETTINGS > ALIENAPPS.

2. On the AlienApps page, click SpyCloud.

The Status tab is displayed, but it does not provide status information until the AlienApp for Dark

Web Monitoring is enabled.

3. Select the sensor that you want to use for the enabled AlienApp.

4. At the top-right of the page, click Enable.

5. If you want to monitor a list of email addresses, select the Email Watchlist tab.

The email watchlist supports up to 10 email addresses. For each address that you want to add, click Add Email.

In the Add Email dialog, enter the Email address and click Add.

USM Anywhere™ Deployment Guide 477

Configuring the AlienApp for Dark Web Monitoring

The email watchlist includes the new email address and the VERIFIED status = No. USM

Anywhere automatically sends a message to the email address to verify it. Upon verification, the

AlienApp for Dark Web Monitoring includes the address in its queries. If an email address remains unverified, click Resend Verification Email to send the message again.

6. If you want to monitor a domain, select the Domain Watchlist tab.

The domain watchlist supports one domain. Click Add Domain.

In the Add Domain dialog, enter the Domain and click Add.

478 USM Anywhere™ Deployment Guide

Configuring the AlienApp for Dark Web Monitoring

This adds the domain to the watchlist, but it is not yet verified. Copy the value of the

VERIFICATION KEY and click Verify Domain.

The Verify Domain dialog provides instructions for adding the verification key to your domain.

When you have the information that you need, click Verify Domain to close the dialog. This also executes a verification check that is successful if you have already completed the configuration.

There is also an automated job that checks every six hours to verify the domain.

USM Anywhere™ Deployment Guide 479

USM Anywhere Environment Settings

The Setup Wizard helps first-time users configure USM Anywhere security capabilities within minutes. Its simple, step-by-step workflow lets you l

Configure sensors l

Manage logs l

Perform authenticated scans on your assets

But, before you can start seeing the results, there are certain tasks you must perform in your network to ensure that USM Anywhere is receiving l

Network firewall allows communication with USM Anywhere.

Operating system forwards all relevant logs to USM Anywhere.

USM Anywhere™ Deployment Guide 480

Log Management

USM Anywhere collects third-party device data through syslog on port 514 by default. To configure any third-party devices to send data to USM Anywhere, you must give them the IP address of your

USM Anywhere Sensor and the port number.

Important: If you don't allow the use of a privileged port (< 1024) on your production system, you can change the port to a non-privileged number on (SETTINGS > DEPLOYMENT >

Sensor Apps > Syslog Server). However, be aware that if you change this in

USM Anywhere, you also need to configure your third-party device to use the new port number.

Remote Log Data Transfer on a Platform or Third-Party Device l

Log collection from a Linux System —

Log collection from a Windows System —

Enabling AWS Log Collection

Log collection from AWS —

Log collection from other devices using a plugin —

Logs from Linux Using osquery

Disabling the Syslog Server App

The Syslog Server app is enabled by default. There is no action needed from the user for enablement. However, if you want to disable it for some reason, follow this procedure.

To disable log data receipt from third-party devices

1. From the USM Anywhere web UI, choose SETTINGS > DEPLOYMENT to open the

Deployment page.

2. Under Sensors, click Syslog Server.

3. On the STATUS tab, select SENSOR:<SENSOR_TYPE> and click DISABLE.

File Integrity Monitoring

File integrity monitoring (FIM) is a mechanism for validating the integrity of operating system and application software files using a verification method between the current file state and a known, good baseline. It is one of the most powerful techniques used to secure IT infrastructures and business data against a wide variety of both known and unknown threats.

481 USM Anywhere™ Deployment Guide

File Integrity Monitoring

FIM for Linux

For Linux systems, you can enable FIM within USM Anywhere by configuring the osquery agent to monitor and track file changes on those systems. The osquery configuration file (typically named osquery.conf

) contains the configuration options and queries that osquery uses when it runs.

AlienVault provides a default configuration file that you can use to enable FIM for Linux systems in your USM Anywhere environment to identify system and software file changes and forward this information to the USM Anywhere Sensor.

For more information about installing and configuring osquery on your Linux systems, see

Collecting

FIM for Windows

For Windows systems, you can use FIM to identify changes in system files, folders, and Microsoft

Windows registries. To use FIM, you configure Windows systems so that USM Anywhere can view

Windows audit object access events. To do so, you need to enable file auditing and update security policy settings. After applying policy changes to include audit object events in Windows security logs,

NXLog will forward those events to the USM Anywhere Sensor.

See