Log Exporter Instructions for Specific SIEM

This section shows how to configure SIEM applications to receive logs optimally.

Notes:

  • When using Client Authentication, you must provide the absolute path to the client certificate.

  • Make sure the "Common Name" is unique in every certificate.

Rsyslog

By default, Rsyslog is not configured to use the RFC 5424 timestamp format.

Therefore, you should manually change the setting on the Rsyslog server for it to be compliant with the Log Exporter output format.

  1. Edit the /etc/rsyslog.conf file:

    vi /etc/rsyslog.conf

  2. Comment out this line (add the # character in the beginning), if it is not commented out already:

    #"$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat"

  3. Add this line in the file:

    $ActionFileDefaultTemplate RSYSLOG_SyslogProtocol23Format

  4. Save the changes in the file and exit the editor.

  5. Restart the Rsyslog service:

    service rsyslog restart

ArcSight

ArcSight recommends to name the server certificate file as "syslog-ng".

To name the certificate:

Convert the key to the P12 format:

openssl pkcs12 -inkey syslogServer.key -in syslogServer.crt -export -out syslog-ng.p12 -name "syslogng-alias" -password pass:changeit

To make sure the value of the environment variable ARCSIGHT_HOME is the connector install directory:

  1. Run the certificates manager on the Linux KDE console:

    $ARCSIGHT_HOME/current/bin/arcsight agent keytoolgui

  2. From the File menu, open the keystore:

    $ARCSIGHT_HOME/current/jre/lib/security/cacerts

    The password "changeit".

  3. From the menu, select Import Trusted Certificate.

  4. From the file dialog, select Ca.pem and save it.

  5. Save the changes and close the certificate manager.

To edit the "agent.properties" file to enable mutual authentication:

  1. Edit the file:

    vi $ARCSIGHT_HOME//current/user/agent/agent.properties

  2. Change this value to true:

    syslogng.mutual.auth.enabled=true

  3. Add these lines to the end:

    syslogng.tls.keystore.file=user/agent/syslog-ng.p12

    syslogng.tls.keystore.alias=syslogng-alias

  4. Restart the connector service:

    /etc/init.d/arc_connector_name restart

Splunk

  1. Generate the server certificate file in the PEM format:

    cat syslogServer.crt syslogServer.key RootCA.pem > splunk.pem

  2. Update the inputs.conf file on the Splunk server:

    1. Edit the file:

      vi /opt/splunk/etc/apps/<Name of the app, where the configuration is saved>/local/inputs.conf

    2. Configure these settings to use TLS:

      [SSL]
serverCert = <Full path to CA PEM file>
sslPassword = <Challenge Password>
requireClientCert = true
[tcp-ssl://<Port>]
index = <Index>

    3. Save the changes in the file and exit the editor.

  3. Update the server.conf file on the Splunk server:

    1. Edit the file:

      vi /opt/splunk/etc/system/local/server.conf

    2. Configure these settings:

      [sslConfig]
sslRootCAPath = <Full path to CA PEM file>

[SSL]
cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH

    3. Save the changes in the file and exit the editor.

  4. Restart the Splunk service:

    /opt/splunk/bin/splunk restart

QRadar

  1. In the Authentication Mode field, select TLS And Client Authentication.

    When you use Client Authentication, you must provide the absolute path to the client certificate.

  2. Upload the Check Point certificate and private key to QRadar to the same directory.

  3. Enter the absolute path to the uploaded files in the Provide Certificate option.