{"type":"doc","content":[{"type":"heading","attrs":{"level":4},"content":[{"text":"Topics Discussed","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"},"minLevel":{"value":"3"},"_parentId":{"value":"3519581253"}},"macroMetadata":{"macroId":{"value":"edefea5d-c022-4944-a1af-ef2b356a462c"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"2cca8255-d865-4f22-a3f0-c82edf623ff5"}},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"You can use this document to learn about the specific, high-level steps needed to obtain Log Relay, and send additional log types to Armor's Security Information & Event Management (SIEM).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt","parameters":{"macroParams":{"_parentId":{"value":"3519581253"},"name":{"value":"Remote Log Collection Permissions"}},"macroMetadata":{"macroId":{"value":"6f08abc62a54b0c0becfa55e0bcedfb8"},"schemaVersion":{"value":"1"},"title":"Excerpt"}},"localId":"7edc1f70-2903-45e4-b1af-045921158a61"},"content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"To obtain Log Relay and to configure your account for remote log collection, you must have the following AMP permissions added to your account: ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write Virtual Machine","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete Log Management","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Log Endpoints","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Log Relays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write Log Relays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete Log Relays","type":"text"}]}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Before you begin:","type":"text"}]},{"type":"paragraph","content":[{"text":"For Armor Enterprise Cloud users, you must already have a virtual machine in your account","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To learn how to create a virtual machine, see ","type":"text"},{"text":"Virtual Machines","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"Virtual Machines","versionAtSave":"271"},"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519587352"}}]},{"text":".","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"For Armor Anywhere users, you must already have downloaded and installed the Armor Agent.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To learn how to download the Armor Agent, see ","type":"text"},{"text":"Install the Armor Anywhere Agent - Linux","type":"text","marks":[{"type":"link","attrs":{"href":"https://armor-defense.atlassian.net/wiki/pages/createpage.action?spaceKey=KBSS&title=Install%20the%20Armor%20Anywhere%20Agent%20-%20Linux"}}]},{"text":".","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"For introductory information on Log Relay, see ","type":"text"},{"text":"Introduction to Log Relay","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"Introduction to Log Relay","versionAtSave":"28"},"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519581265"}}]},{"text":".","type":"text"}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Review Requirements","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt-include","parameters":{"macroParams":{"":{"value":"Introduction to Log Relay"},"_parentId":{"value":"3519581253"},"name":{"value":"Review Requirements"},"_referencedContentId":{"value":"3519581265"},"nopanel":{"value":"true"}},"macroMetadata":{"macroId":{"value":"ceaa98ec-52ed-463a-85cb-f1749f09d990"},"schemaVersion":{"value":"1"},"title":"Insert excerpt"}},"localId":"696437e1-71bc-4226-a111-002e3cc226fe"}}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"obtain-log-relay"},"legacyAnchorId":{"value":"ObtainLogRelayforRemoteLogCollection-obtain-log-relay"},"_parentId":{"value":"3519581253"}},"macroMetadata":{"macroId":{"value":"f332b377cde7c73ab2d33be117670457"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"9c9a07d0-bb6e-455c-b4c4-0774143ee4cc"}},{"text":"Obtain Log Relay","type":"text","marks":[{"type":"strong"}]}]},{"type":"rule"},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"When you convert a virtual machine into a Log Relay device, your virtual machine / device will still contain the default Armor Agent components, such as FIM, Malware, Patching, etc.","type":"text"}]}]},{"type":"paragraph"},{"type":"expand","attrs":{"title":"Option 1: For Armor Anywhere Users"},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Armor Management Portal (AMP), in the left-side navigation, click ","type":"text"},{"text":"Infrastructure","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Virtual Machines","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Locate and hover over the desired virtual machine.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click the vertical ellipses.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Convert","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"to Log Relay","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"},{"text":" ","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.armor.com/download/attachments/46498250/Select%20Convert%20to%20Log%20Relay.png?version=1&modificationDate=1559751712000&api=v2"}}]},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"link":"https://docs.armor.com/download/attachments/46498250/Select%20Convert%20to%20Log%20Relay.png?version=1&modificationDate=1559751712000&api=v2","width":"500","id":"3386c656-6935-454b-badf-80c0133d3619","collection":"contentId-3519581253","height":""}}},{"text":" ","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.armor.com/download/attachments/46498250/Select%20Convert%20to%20Log%20Relay.png?version=1&modificationDate=1559751712000&api=v2"}}]},{"text":" ","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Review pricing information, and then click ","type":"text"},{"text":"Convert VM to Log Relay","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"},{"type":"hardBreak"},{"text":" ","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.armor.com/download/attachments/46498250/Review%20and%20accept%20terms.png?version=1&modificationDate=1559751712000&api=v2"}}]},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"link":"https://docs.armor.com/download/attachments/46498250/Review%20and%20accept%20terms.png?version=1&modificationDate=1559751712000&api=v2","width":"500","id":"3b914431-ca9b-438e-a4ed-51bd64fd6a9f","collection":"contentId-3519581253","height":""}}},{"text":" ","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.armor.com/download/attachments/46498250/Review%20and%20accept%20terms.png?version=1&modificationDate=1559751712000&api=v2"}}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"You will be redirected to the ","type":"text"},{"text":"Virtual Machines","type":"text","marks":[{"type":"strong"}]},{"text":" screen. ","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Under ","type":"text"},{"text":"Type","type":"text","marks":[{"type":"strong"}]},{"text":", the virtual machine will be labeled as ","type":"text"},{"text":"Log Relay","type":"text","marks":[{"type":"strong"}]},{"text":". (By default, the Armor agent will update the virtual machine within 15 minutes.)","type":"text"},{"type":"hardBreak"},{"text":" ","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.armor.com/download/attachments/46498250/View%20updated%20type.png?version=1&modificationDate=1559751712000&api=v2"}}]},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"link":"https://docs.armor.com/download/attachments/46498250/View%20updated%20type.png?version=1&modificationDate=1559751712000&api=v2","width":"500","id":"a2e654fe-31a3-413f-99d5-d29ccde02269","collection":"contentId-3519581253","height":""}}}]}]}]}]},{"type":"paragraph"},{"type":"expand","attrs":{"title":"Option 2: For Armor Complete Users"},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the ","type":"text"},{"text":"PUT Assign Log Collector ","type":"text","marks":[{"type":"strong"}]},{"text":"API call to add Log Relay to your account.","type":"text"}]},{"type":"extension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

In some cases, the terms Log Depot, Host Log Collector, or Log Relay may be used interchangeably.

","nestedContent":{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"In some cases, the terms ","type":"text"},{"text":"Log Depot","type":"text","marks":[{"type":"strong"}]},{"text":",","type":"text"},{"text":" Host Log Collector","type":"text","marks":[{"type":"strong"}]},{"text":", or ","type":"text"},{"text":"Log Relay","type":"text","marks":[{"type":"strong"}]},{"text":" may be used interchangeably.","type":"text"}]}]}],"version":1},"reason":"A note macro in a list item can't be created or edited in the new editor."}}}]}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"4012c726-cf98-4881-8fb9-c9e786acd0c7"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"METHOD / TYPE","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[545.0]},"content":[{"type":"paragraph","content":[{"text":"PUT","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"API CALL / URL","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[545.0]},"content":[{"type":"paragraph","content":[{"text":"/vms/core/{coreInstanceId}/profile ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"PARAMETERS","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[545.0]},"content":[{"type":"paragraph","content":[{"text":"You must enter your virtual machine's coreInstanceId.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"To locate this ID, in AMP, access the ","type":"text"},{"text":"Virtual Machine","type":"text","marks":[{"type":"strong"}]},{"text":" screen, click the desired virtual machine to expand, and then copy the ","type":"text"},{"text":"Agent","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"ID","type":"text","marks":[{"type":"strong"}]},{"text":". The Agent ID is a combination of numbers and letters. ","type":"text"}]}]},{"type":"paragraph"},{"type":"mediaSingle","attrs":{"layout":"center","width":876,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":2527,"type":"external","url":"https://docs.armor.com/download/attachments/74744972/Find%20the%20agent%20id.png?version=1&modificationDate=1615222920000&api=v2","height":714}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[185.0]},"content":[{"type":"paragraph","content":[{"text":"FULL API CALL / URL","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[545.0]},"content":[{"type":"codeBlock","content":[{"text":"PUT https://api.armor.com//vms/core/1gfh39d-hdd78-dhd73-434/profil","type":"text"}]}]}]}]},{"type":"orderedList","attrs":{"order":2},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Contact Armor Support to add a custom file path via a host log collector.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"After you have converted your virtual machine into a Log Relay device, see ","type":"text"},{"text":"Create and Configure Remote Log Sources","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"Create and Configure Remote Log Sources","versionAtSave":"20"},"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519581486"}}]},{"text":" to learn how to create and configure a remote log source.","type":"text"}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"heading","attrs":{"level":4},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"paragraph","content":[{"text":"In general, if you are having issues adding Log Relay to a remote log device, consider that:","type":"text"}]},{"type":"paragraph","content":[{"text":"You need to update your permissions in AMP.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"AMP","type":"text","marks":[{"type":"strong"}]},{"text":", you must have the following permissions added to your account:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write Virtual Machine","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete Log Management","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Log Endpoints","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Log Relays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write Log Relays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete Log Relays","type":"text"}]}]}]}]}]}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"To add the above-mentioned AMP permissions to your account, see ","type":"text"},{"text":"Roles and Permissions","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"isRenamedTitle":true,"linkType":"page","contentTitle":"Roles and Permissions","versionAtSave":"207"},"href":"https://armor-defense.atlassian.net/wiki/spaces/KB/pages/3519587062"}}]},{"text":".","type":"text"}]}]}],"version":1}

Browser not supported