{"type":"doc","content":[{"type":"paragraph"},{"type":"heading","attrs":{"level":4},"content":[{"text":"Topics Discussed","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"},"minLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"24cc2a57-9a9b-4b73-87ed-f716f7662a37"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"250d89c0-971f-4359-a762-7967eade9057"}},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"To obtain Log Relay and to configure your account for remote log collection, you must have the following AMP permissions added to your account:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write Virtual Machine","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete Log Management","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Log Endpoints","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Log Relays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write Log Relays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete Log Relays","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"You can use this document to send compliance logs to Armor's Data Lake.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Pre-Deployment Considerations","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"To create a remote Log Relay, you must already have:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A Log Relay server on your account","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To learn how to add Log Relay to your account, see ","type":"text"},{"text":"Obtain Log Relay for Remote Log Collection","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/KB/pages/3519581253"}}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configured the system clock","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Configure Your Device or Application","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Configure the remote log source's logs to be sent to a designated Armor Log Relay device","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure the remote log source to forward syslogs to the IP address of the corresponding Armor Log Relay device.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To locate your IP address in AMP, in the left-side navigation, click ","type":"text"},{"text":"Infrastructure","type":"text","marks":[{"type":"strong"}]},{"text":", click ","type":"text"},{"text":"Virtual Machines","type":"text","marks":[{"type":"strong"}]},{"text":", and then review the","type":"text"},{"text":" Primary IP ","type":"text","marks":[{"type":"strong"}]},{"text":"column for the corresponding virtual machine.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure the remote log source to forward syslogs to the appropriate protocol/port of the corresponding Armor Log Relay device.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For UDP, enter ","type":"text"},{"text":"udp/5140","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For TCP, enter ","type":"text"},{"text":"tcp/5141","type":"text","marks":[{"type":"strong"}]}]}]}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"If required, configure logs to be sent to a designated Armor Log Relay device over SSL/TLS:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"SSL/TLS Secured Communications","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"In most cases, we assume network isolation using subneting and/or firewalls are in place to secure communication between a log source and your Log Relay. There are a few exceptions to this assumption:","type":"text"}]},{"type":"paragraph","content":[{"text":"In scenarios where it is typical to have data traverse the Internet, or in scenarios where a device ","type":"text"},{"text":"only","type":"text","marks":[{"type":"em"}]},{"text":" supports TLS-secured transport, the Log Relay config supports TLS ingestion.","type":"text"}]},{"type":"paragraph","content":[{"text":"For Steps to enable SSL; see expansion below:","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"expand","attrs":{"title":"Steps To enable SSL"},"content":[{"type":"paragraph","content":[{"text":"Certificates","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"When you install the Log Relay software, a self-signed certificate and its corresponding private key are generated and placed in ","type":"text"},{"text":"/opt/armor/logrelay.pem","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"/opt/armor/logrelay.key","type":"text","marks":[{"type":"strong"}]},{"text":" respectively. If the device sending logs requires strict SSL checks, you have a few options to satisfy this requirement:","type":"text"}]},{"type":"paragraph","content":[{"text":"Exporting the Self-Signed Certificate","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"You may export the certificate and add it to the trust store of the log source device (if supported). You copy the PEM certificate from the Log Relay server and then consult the vendor-supplied documentation to install a new trusted certificate.","type":"text"}]},{"type":"paragraph","content":[{"text":"Using a Certificate from a Valid CA","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"You can also generate a CSR and request a certificate from a CA the log source device already trusts. Using ","type":"text"},{"text":"openssl","type":"text","marks":[{"type":"link","attrs":{"href":"http://100.64.215.25/"}}]},{"text":" you can generate a new CSR. We recommend using a configuration file to supply Subject Alternate Names (SANs) for the various DNS hostnames pointed at your Log Relay in addition to its IP address.","type":"text"}]},{"type":"paragraph","content":[{"text":"logrealy.cnf","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph"},{"type":"codeBlock","content":[{"text":"[ req ]\n\ndefault_bits = 2048\n\ndistinguished_name = req_distinguished_name\n\nreq_extensions = req_ext\n\n\n\n[ req_distinguished_name ]\n\ncountryName = \n\nstateOrProvinceName = \n\nlocalityName = \n\norganizationName = \n\ncommonName = \n\n\n\n[ req_ext ]\n\nsubjectAltName = @alt_names\n\n\n\n[alt_names]\n\nDNS.1 = \n\nDNS.2 = \n\nDNS.3 = ","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Fill in the values in angle brackets above with applicable values. For <","type":"text"},{"text":"COUNTRY","type":"text","marks":[{"type":"strong"}]},{"text":"> us the 2-digit ISO country code. For <","type":"text"},{"text":"STATE","type":"text","marks":[{"type":"strong"}]},{"text":">. you can use the 2-digit abbreviation or the full name of your state or province.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the IP address of the Log Relay changes frequently or you already use a DNS hostname as the ","type":"text"},{"text":"default","type":"text","marks":[{"type":"em"}]},{"text":" means of addressing the Log Relay, use the DNS hostname instead of the IP address in <","type":"text"},{"text":"LOG_RELAY_IP_ADDRESS","type":"text","marks":[{"type":"strong"}]},{"text":">.","type":"text"}]},{"type":"paragraph","content":[{"text":"Add any DNS hostnames that resolve to this Log Relay using the ","type":"text"},{"text":"alt_names","type":"text","marks":[{"type":"strong"}]},{"text":" section of the config. If you're not using any SANs, remove the [","type":"text"},{"text":"alt_names","type":"text","marks":[{"type":"strong"}]},{"text":"] and [","type":"text"},{"text":"req_ext","type":"text","marks":[{"type":"strong"}]},{"text":"] sections and remove the","type":"text"},{"type":"hardBreak"},{"text":"reference under the [","type":"text"},{"text":"req","type":"text","marks":[{"type":"strong"}]},{"text":"] section.","type":"text"}]},{"type":"paragraph","content":[{"text":"Then use ","type":"text"},{"text":"openssl ","type":"text","marks":[{"type":"strong"}]},{"text":"to request the certificate:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl req -new rsa:2048 -key /opt/armor/logrelay.key -nodes -out logrelay.csr -config logrelay.cnf","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that you may need to run this command as root as the key is owned by the Log Relay service account.","type":"text"}]},{"type":"paragraph","content":[{"text":"After you've generated your CSR and received the certificate from the CA, ensure that it is in PEM format and upload it to your Log Relay machine. Ensure that is accessible to the Log Relay service account.","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the file is uploaded and has the correct permissions, update the override environment file to point at the path of the new certificate. Create a file at ","type":"text"},{"text":"/etc/sysconfig/armor-logstash.override ","type":"text","marks":[{"type":"strong"}]},{"text":"with the following contents:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ARMOR_LOGSTASH_SSL_CERT='/path/to/cert.pem'","type":"text"}]},{"type":"paragraph","content":[{"text":"If you used a key other than the one included with the Log Relay, you can specify it in this file as well:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ARMOR_LOGSTASH_SSL_KEY='/path/to/private.key'","type":"text"}]},{"type":"paragraph","content":[{"text":"Update the Storage Only configuration to leverage the new certificate. Note that this key must not have a password and be in PKCS8 format. You can use file permissions and/or selinux policies to protect the key.","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Update Storage Configuration Certificate","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"/opt/armor/logstash-{version}/config/pipeline-storage/pipeline-storage.conf","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"To include the following lines in the \"pipeline_storage_input_tcp\" configuration","type":"text"}]},{"type":"paragraph"},{"type":"codeBlock","content":[{"text":"ssl_enable => \"true\"\n\nssl_cert => \"${ARMOR_LOGSTASH_SSL_CERT}\"\n\nssl_key => \"${ARMOR_LOGSTASH_SSL_KEY}\"\n\nssl_verify => \"false\"","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"The final version should be: ","type":"text"}]},{"type":"paragraph"},{"type":"codeBlock","content":[{"text":"input {\n\n tcp {\n\n id => \"pipeline_storage_input_tcp\"\n\n port => 5141\n\n codec => line\n\n add_field => {\n\n \"type\" => \"storage\"\n\n \"[logsource][relay_port]\" => \"5141\"\n\n }\n\n ssl_enable => \"true\"\n\n ssl_cert => \"${ARMOR_LOGSTASH_SSL_CERT}\"\n\n ssl_key => \"${ARMOR_LOGSTASH_SSL_KEY}\"\n\n ssl_verify => \"false\"\n\n }\n\n}","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"After creating or updating these configuration files, restart the Log Relay service:","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo systemctl restart armor-logstash.service","type":"text"}]}]}],"version":1}

Browser not supported