Integrating AIFF with NVIDIA DOCA Argus

1. Connect with SmartConsole to the applicable Domain.

2. From the left navigation panel, click Gateways & Servers.

3. Double-click the AIFF Security Gateway object.

4. In the left panel, click the General Properties page.

5. On the Threat Prevention tab, select Anti-Virus.

6. In the Anti-Bot and Anti-Virus First Time Activation window:

   1. Select According to the Threat Prevention Policy.

   2. Click OK.

7. In the left panel, on the Anti-Bot and Anti-Virus page, leave the default settings.

8. Click OK to close the AIFF Security Gateway object.

On the AIFF Container, it is necessary to configure the DOCA Argus log settings.

1. From the DOCA Argus Container's YAML configuration file (as defined in "SERVICE_CONFIG_FILE"), copy these settings:

   1. In the section "volumes:", copy the settings for "name: logs-doca-app-shield-activity-report".

      Example:

      volumes: - name: firewall-data hostPath: path: /opt/CheckPoint/AICloudProtect/data type: DirectoryOrCreate - name: firewall-stat hostPath: path: /opt/CheckPoint/AICloudProtect/stat type: DirectoryOrCreate - name: dev-vfio hostPath: path: /dev/vfio type: DirectoryOrCreate - name: logs-doca-app-shield-activity-report hostPath: path: /var/log/doca_app_shield_activity_report type: DirectoryOrCreate

   2. In the section "volumeMounts:", copy the settings for "name: logs-doca-app-shield-activity-report".

      Example:

      volumeMounts: - name: firewall-data mountPath: /data - name: firewall-stat mountPath: /stat - name: dev-vfio mountPath: /dev/vfio readOnly: true - name: logs-doca-app-shield-activity-report mountPath: /var/log/doca_app_shield_activity_report

2. On the AIFF Container, in the configuration file "AIFF.yaml":

   1. In the section "volumes:", configure the same settings for "name: /var/log/doca_argus_activity_report" as configured on the DOCA Argus Container.

   2. In the section "volumeMounts:", configure the same settings for "name: /var/log/doca_argus_activity_report" as configured on the DOCA Argus Container.

On the DOCA Argus Container, it is necessary to configure the AIFF log settings.

1. From the AIFF Container, from the configuration file "AIFF.yaml", copy these settings:

   1. In the section "volumes:", copy the settings for "name: logs-argus-activity-report".

      Example:

      volumes: - name: logs-argus-service hostPath: path: /var/log/doca_argus type: DirectoryOrCreate - name: logs-argus-activity-report hostPath: path: /var/log/doca_argus_activity_report type: DirectoryOrCreate - name: conf-argus-config hostPath: path: /etc/doca_argus_config type: DirectoryOrCreate

   2. In the section "volumeMounts:", copy the settings for "name: logs-argus-activity-report".

      Example:

      volumeMounts: - name: logs-argus-service mountPath: /var/log/doca_argus - name: logs-argus-activity-report mountPath: /var/log/doca_argus_activity_report - name: conf-argus-config mountPath: /etc/doca_argus_config

2. On the DOCA Argus Container, in the YAML configuration file (as defined in "SERVICE_CONFIG_FILE"):

   1. In the section "volumes:", configure the same settings for "name: logs-argus-activity-report" as configured on the AIFF Container).

   2. In the section "volumeMounts:", configure the same settings for "name: logs-argus-activity-report" as configured on the AIFF Container.

   3. In the section "output:", make sure the value of the parameter "log_folder_path" is not "false".

      Example:

      output: # Log events to stdout. Normally disabled for production. log_stdout: false # Events will be logged to this file - 'false' to disable log_folder_path: /var/log/doca_argus_activity_report ...

   4. In the section "collection:", make sure the values of all these parameters are "true":

      • In the section "container:":

        • container_started: true

        • container_terminated: true

      • In the section "process:":

        • process_created: true

      • In the section "network_connection:":

        • network_connection_created: true