Versions Compared

Old Version 2

changes.mady.by.user Former user

Saved on

compared with

New Version 3

changes.mady.by.user Luke Fritz (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Section
id117351126
Section
id117351128
Section
background-color$lightGrayColor
id117351124

Topics Discussed

Table of Contents
maxLevel3
minLevel3

Section
id117351127

Insert excerpt
ESLP:Permissions for Log Relay and Remote Log Collection (snippet)
ESLP:Permissions for Log Relay and Remote Log Collection (snippet)
nopaneltrue

You can use this document to send Imperva Incapsula logs to Armor's Security Information & Event Management (SIEM).


Pre-deployment Considerations

To create a remote Log Relay, you must already have:


Anchor
configure IAM role
configure IAM role
Configure the IAM Role

Expand
titleConfigure The IAM Role For An EC2 Server
  1. Login into the AWS console.
  2. Go to the IAM service.

  3. Click Roles.

    Image Added

  4. Click Create role.

    Image Added

  5. Select AWS service, then select EC2 as the service that will use this role.

    Image Added

  6. Click Next: Permissions.
  7. Filter (search) policies on S3.

  8. Select the AmazonS3ReadOnlyAccess policy.

    Image Added

  9. Click Next: Tags.

  10. (Optional) Add tags.

    Image Added

  11. Click Next: Review.

  12. In Role Name, enter a name that indicates what the role is being used for.

    Image Added

  13. Click Create role.

Expand
titleConfigure The IAM Role For A Non-EC2 Server
  1. Login into the AWS console.
  2. Go to the IAM service.

  3. Click Users.

    Image Added

  4. Click Add User.

  5. Enter the user name.

  6. For access type, select Programmatic access.

    Image Added

  7. Click Next: Permissions.

  8. Select Attach existing policies directly.

  9. Filter (search) policies on S3.

  10. Select the AmazonS3ReadOnlyAccess policy.

    Image Added

  11. Click Next: Tags.

  12. (Optional) Add tags.

    Image Added

  13. Click Next: Review.

  14. Click Create user.

  15. Copy the Access key ID and Secret access key, or download the user security credentials.

    Image Added

  16. Log into your log relay server.

  17. Run the following command to get the home path of the armor-logstash

    Code Block
    themeMidnight
    ng: getent passwd armor-logstash
    • Sample results: armor-logstash:x:1002:1002::/opt/armor/logstash-6.7.0:/bin/bash.
  18. Copy the home path: /opt/armor/logstash-6.7.0.
  19. Navigate to this path: cd /opt/armor/logstash-6.7.0.
  20. Create the AWS folder: mkdir .aws.

  21. Create the credentials file in the new directory by running the following command:

    Code Block
    themeMidnight
     nano .aws/credentials

  22. Add the following (default) to the file:

    Code Block
    themeMidnight
    [default]
# Your access key id
aws_access_key_id = XXXXXXXXXXXXXXXXXXXX

# Your secret access key
aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  23. Save the file.
  24. Restart logstash.
    • systemctl restart armor-logstash



Assign a Role to the EC2 Instance

  1. In the AWS console, go to the EC2 service.
  2. Click Instances to find the EC2 instance that is the log relay, then click the box next to the instance.

  3. Select Actions > Instance Settings > Attach/Replace IAM Role.

    Image Added

  4. In IAM role, select the role created.

    Image Added

  5. Click Apply.


Import Imperva Incapsula Logs from S3

  1. Log into your log relay server.
  2. Navigate to the /opt/armor/log-relay/conf.d folder.
  3. Create a new file using the following naming pattern: <pipeline_name>.<friendly_id>.env.
    • For example: pipeline-s3.incapsula.env
      • Pipeline name = "pipeline-s3"
      • Friendly_id (friendly name) = "incapsula"

  4. Add the following content to the newly created .env file. This will be used to populate the template and create the pipeline.

    Code Block
    themeMidnight
    # The name of the S3 bucket
bucket_name="example-bucket-name"

# The region where the S3 bucket is provisioned
region="example-region"

# The type of logs being collected by this source
log_type="imperva-incapsula"

# The codec used to read the raw log files
codec="line"
  5. After you have created the .env file and made any necessary changes, you will need to restart logstash.
    • systemctl restart armor-logstash


Verify Logs in AMP

In the Armor Management Portal (AMP), you can view the actual logs to confirm that the configuration was successful.

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.
  2. Click Log & Data Management, and then selectSearch.
  3. In theSourcecolumn, review the source name to locate the newly created Imperva Incapsula remote log source.
    1. In the search field, you can also enter "incapsula" to locate Imperva Incapsula messages.




Was this helpful?