Versions Compared

Old Version 3

changes.mady.by.user Luke Fritz

Saved on

compared with

New Version Current

changes.mady.by.user Aaron Gabriel (Deactivated)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

...

...

...

...

...

...

...

...

...

...

...

id117351128

...

background-color$lightGrayColor
id117351124

Topics Discussed

Table of Contents
maxLevel3
minLevel3

...

...

id117351127

Insert excerpt

...

Obtain Log Relay

...

for Remote Log Collection

...

Obtain Log Relay for Remote Log Collection
nameRemote Log Collection

...

Permissions
nopaneltrue

You can use this document to send Imperva Incapsula logs to Armor's Security Information & Event Management (SIEM).


Pre-deployment Considerations

...

To create a remote Log Relay, you must already have:

Anchor

...

Configure-IAM

...

-Role

...

Configure-IAM

...

-Role
Configure the IAM Role

...

Expand
titleConfigure The IAM Role For An EC2 Server

  1. Login into the AWS console.

  2. Go to the IAM service.

  3. Click Roles.

    Image Modified

  4. Click Create role.

    Image Modified

  5. Select AWS service, then select EC2 as the service that will use this role.

    Image Modified

  6. Click Next: Permissions.

  7. Filter (search) policies on S3.

  8. Select the AmazonS3ReadOnlyAccess policy.

    Image Modified

  9. Click Next: Tags.

  10. (Optional) Add tags.

    Image Modified

  11. Click Next: Review.

  12. In Role Name, enter a name that indicates what the role is being used for.

    Image Modified

  13. Click Create role.

Midnight
Expand
titleConfigure The IAM Role For A Non-EC2 Server

  1. Login into the AWS console.

  2. Go to the IAM service.

  3. Click Users.

    Image Modified

  4. Click Add User.

  5. Enter the user name.

  6. For access type, select Programmatic access.

    Image Modified

  7. Click Next: Permissions.

  8. Select Attach existing policies directly.

  9. Filter (search) policies on S3.

  10. Select the AmazonS3ReadOnlyAccess policy.

    Image Modified

  11. Click Next: Tags.

  12. (Optional) Add tags.

    Image Modified

  13. Click Next: Review.

  14. Click Create user.

  15. Copy the Access key ID and Secret access key, or download the user security credentials.

    Image Modified

  16. Log into your log relay server.

  17. Run the following command to get the home path of the armor-logstash

    Code Block
theme
ng: getent passwd armor-logstash

  • Sample results: armor-logstash:x:1002:1002::/opt/armor/logstash-6.7.0:/bin/bash.

  • Copy the home path: /opt/armor/logstash-6.7.0.

  • Navigate to this path: cd /opt/armor/logstash-6.7.0.

  • Create the AWS folder: mkdir .aws.

  • Create the credentials file in the new directory by running the following command:

    Code Block
    • themeMidnight
    1.  nano .aws/credentials

    2. Add the following (default) to the file:

      Code Block
    themeMidnight
    1. [default]
# Your access key id
aws_access_key_id = XXXXXXXXXXXXXXXXXXXX

# Your secret access key
aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    2. Save the file.

    3. Restart logstash.

      • systemctl restart armor-logstash



    Assign a Role to the EC2 Instance

    ...

    1. In the AWS console, go to the EC2 service.

    2. Click Instances to find the EC2 instance that is the log relay, then click the box next to the instance.

    3. Select Actions > Instance Settings > Attach/Replace IAM Role.

      Image Modified

    4. In IAM role, select the role created.

      Image Modified

    5. Click Apply.


    Import Imperva Incapsula Logs from S3

    ...

    1. Log into your log relay server.

    2. Navigate to the /opt/armor/log-relay/conf.d folder.

    3. Create a new file using the following naming pattern: <pipeline_name>.<friendly_id>.env.

      • For example: pipeline-s3.incapsula.env

        • Pipeline name = "pipeline-s3"

        • Friendly_id (friendly name) = "incapsula"

    4. Add the following content to the newly created .env file. This will be used to populate the template and create the pipeline.

      Code Block

    ...

    themeMidnight
    1. # The name of the S3 bucket
bucket_name="example-bucket-name"

# The region where the S3 bucket is provisioned
region="example-region"

# The type of logs being collected by this source
log_type="imperva-incapsula"

# The codec used to read the raw log files
codec="line"

    2. After you have created the .env file and made any necessary changes, you will need to restart logstash.

      • systemctl restart armor-logstash


    Verify Logs in AMP

    ...

    In the Armor Management Portal (AMP), you can view the actual logs to confirm that the configuration was successful.

    1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

    2. Click Log & Data Management, and then select Search.

    3. In the Source column, review the source name to locate the newly created Imperva Incapsula remote log source.

      1. In the search field, you can also enter "incapsula" to locate Imperva Incapsula messages.

    ...