{"type":"doc","content":[{"type":"paragraph"},{"type":"heading","attrs":{"level":4},"content":[{"text":"Topics Discussed","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"},"minLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"4b02e617-da51-434f-972d-1f40eed528b8"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"c4f021be-ac77-4764-af54-4734cc8ca696"}},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt-include","parameters":{"macroParams":{"":{"value":"Obtain Log Relay for Remote Log Collection"},"name":{"value":"Remote Log Collection Permissions"},"nopanel":{"value":"true"}},"macroMetadata":{"macroId":{"value":"8edc6fc3-ebf5-4cd2-9b1c-1296ea295739"},"schemaVersion":{"value":"1"},"title":"Insert excerpt"}},"localId":"c7276db0-e489-406a-bca7-89406a8ab13b"}}]},{"type":"paragraph","content":[{"text":"You can use this document to send ","type":"text"},{"text":"Imperva Incapsula ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]},{"text":"logs to Armor's Security Information & Event Management (SIEM). ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Pre-deployment Considerations","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"To create a remote Log Relay, you must already have:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A Log Relay server on your account","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To learn how to add Log Relay to your account, see ","type":"text"},{"text":"Obtain Log Relay for Remote Log Collection","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/KB/pages/3519581253"}}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configured the system clock","type":"text"}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Configure-IAM-Role"}},"macroMetadata":{"macroId":{"value":"78bc7df1d1fba5c864f4dfbe7d2a9d3e"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"3dab098f-d8c6-4589-bb72-aa9cbbceb5ac"}},{"text":"Configure the IAM Role","type":"text"}]},{"type":"rule"},{"type":"expand","attrs":{"title":"Configure The IAM Role For An EC2 Server"},"content":[{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login into the AWS console.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to the ","type":"text"},{"text":"IAM","type":"text","marks":[{"type":"strong"}]},{"text":" service.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Roles","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"table","content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":77.0},"content":[{"type":"media","attrs":{"width":1280,"id":"728ec26f-f97d-4f62-921e-dc38f18ded8c","collection":"contentId-3519581539","type":"file","height":606},"marks":[{"type":"link","attrs":{"href":"https://docs.armor.com/download/attachments/52757305/IAM_add%20user%20success.png?version=1&modificationDate=1568833558000&api=v2"}}]}]}]}]}]}],"version":1},"reason":"A table in list item can't be created or edited in the new editor."}}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log into your log relay server.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run the following command to get the home path of the armor-logstash","type":"text"}]},{"type":"codeBlock","content":[{"text":"ng: getent passwd armor-logstash","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Sample results: armor-logstash:x:1002:1002::/opt/armor/logstash-6.7.0:/bin/bash.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Copy the home path: /opt/armor/logstash-6.7.0.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Navigate to this path: cd /opt/armor/logstash-6.7.0.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create the AWS folder: ","type":"text"},{"text":"mkdir .aws.","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create the credentials file in the new directory by running the following command:","type":"text"}]},{"type":"codeBlock","content":[{"text":" nano .aws/credentials","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following (default) to the file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"[default]\n# Your access key id\naws_access_key_id = XXXXXXXXXXXXXXXXXXXX\n\n# Your secret access key\naws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart logstash.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"systemctl restart armor-logstash","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Assign a Role to the EC2 Instance","type":"text"}]},{"type":"rule"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the AWS console, go to the ","type":"text"},{"text":"EC2","type":"text","marks":[{"type":"strong"}]},{"text":" service.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Instances","type":"text","marks":[{"type":"strong"}]},{"text":" to find the EC2 instance that is the log relay, then click the box next to the instance.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"Actions","type":"text","marks":[{"type":"strong"}]},{"text":" > ","type":"text"},{"text":"Instance Settings","type":"text","marks":[{"type":"strong"}]},{"text":" > ","type":"text"},{"text":"Attach/Replace IAM Role","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"table","content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"mediaSingle","attrs":{"layout":"align-start","width":73.0},"content":[{"type":"media","attrs":{"width":1280,"id":"87363b33-c942-42f0-bdb3-646df3852531","collection":"contentId-3519581539","type":"file","height":571},"marks":[{"type":"link","attrs":{"href":"https://docs.armor.com/download/attachments/52757305/IAM_attach%20role.png?version=1&modificationDate=1568671910000&api=v2"}}]}]}]}]}]}],"version":1},"reason":"A table in list item can't be created or edited in the new editor."}}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Apply","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Import Imperva Incapsula Logs from S3","type":"text"}]},{"type":"rule"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Log into your log relay server.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Navigate to the ","type":"text"},{"text":"/opt/armor/log-relay/conf.d","type":"text","marks":[{"type":"strong"}]},{"text":" folder.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Create a new file using the following naming pattern: ","type":"text"},{"text":"..env.","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For example: pipeline-s3.incapsula.env","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Pipeline name = \"pipeline-s3\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Friendly_id (friendly name) = \"incapsula\"","type":"text"}]}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add the following content to the newly created .env file. This will be used to populate the template and create the pipeline.","type":"text"}]},{"type":"codeBlock","content":[{"text":"# The name of the S3 bucket\nbucket_name=\"example-bucket-name\"\n\n# The region where the S3 bucket is provisioned\nregion=\"example-region\"\n\n# The type of logs being collected by this source\nlog_type=\"imperva-incapsula\"\n\n# The codec used to read the raw log files\ncodec=\"line\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"After you have created the .env file and made any necessary changes, you will need to restart logstash.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"systemctl restart armor-logstash","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Verify Logs in AMP","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"In the Armor Management Portal (AMP), you can view the actual logs to confirm that the configuration was successful.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Armor Management Portal (AMP), in the left-side navigation, click ","type":"text"},{"text":"Security","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Log & Data Management","type":"text","marks":[{"type":"strong"}]},{"text":", and then select ","type":"text"},{"text":"Search","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"Source","type":"text","marks":[{"type":"strong"}]},{"text":" column, review the source name to locate the newly created Imperva Incapsula remote log source.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the search field, you can also enter \"incapsula\" to locate ","type":"text"},{"text":"Imperva Incapsula ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"messages.","type":"text"}]}]}]}]}]}],"version":1}

Browser not supported