IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Audit log format

    Posted 06/03/21 03:34 AM
    Hi to all,
    I have an appliance ISVA version 10.0.1.0 and I'm trying to send log to ArcSight.

    I made this configuration:
    Under Monitor --> Logs -->Audit Configuration --> Syslog
    I flagged "Enable audit log"
    For "Location of syslog server" I selected "On a remote machine" and I putted as Host an IP address and as Port 5142
    Protocol: TLS
    Certificate Database: pdsrv
    and the other fields are blank.

    After the previous configuration, log are sended to ArcSight in this format:
    <14>1 2021-05-12T10:11:44.761Z RMDTV-ACCDS01 ISAM 3749 - - <CommonBaseEvent creationTime="2021-05-12T09:11:44.761Z" extensionName="IBM_SECURITY_TRUST" globalInstanceId="FIM5fd8a77901791c27961cc56ed0714" sequenceNumber="86759" version="1.1"><contextDataElements name="Security Event Factory" type="eventTrailId"><contextId>FIM_5fd8a76801791c46b734c56ed071497f+1524547317</contextId></contextDataElements><extendedDataElements name="moduleName" type="string"><values>com.tivoli.am.fim.trustserver.sts.modules.STSMapDefault</values></extendedDataElements><extendedDataElements name="action" type="string"><values>Map</values></extendedDataElements><extendedDataElements name="appliesTo" type="string"><values>https://localhost/sps/oauth/oauth20</values></extendedDataElements><extendedDataElements name="ruleName" type="string"><values>Standard_DD2.0PreTokenGeneration </values></extendedDataElements><extendedDataElements name="tokenType" type="string"><values>Not Available</values></extendedDataElements><extendedDataElements name="outcome" type="noValue"><children name="result" type="string"><values>SUCCESSFUL</values></children><children name="majorStatus" type="int"><values>0</values></children></extendedDataElements><extendedDataElements name="issuer" type="string"><values>urn:ibm:ITFIM:oauth20:client::M81ixQhgKVvgqlk0ofn2</values></extendedDataElements><extendedDataElements name="tokenInfo" type="string"><values>null</values></extendedDataElements><extendedDataElements name="token" type="string"><values>null</values></extendedDataElements><sourceComponentId application="IBM Security Access Manager" component="Authentication and Federated Identity" componentIdType="ProductName" executionEnvironment="Linux[amd64]#3.10.0-862.11.6.el7_1.iss8_1.2.x86_64" location="XXX-YYY01" locationType="FQHostname" subComponent="com.tivoli.am.fim.trustserver.sts.modules.STSMapDefault" threadId="Default Executor-thread-1666447" componentType="http://www.ibm.com/namespaces/autonomic/Tivoli_componentTypes"/><situation categoryName="ReportSituation"><situationType xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="ReportSituation" reasoningScope="INTERNAL" reportCategory="SECURITY"/></situation></CommonBaseEvent>

    but ArcSight support need this:
    <114>1 2018-02-01T13:46:41+00:00 aaaaaaa1111.a111.bb.ccc zonename-company-uat_audit_authn.log 26970 - - <event rev\="1.2">\n<date>2018-02-01-13:46:32.388+00:00I-----</date>\n<outcome status\="0">0</outcome>\n<originator blade\="webseald" instance\="zonename-company-uat"><component rev\="1.4">authn</component>\n<event_id>117</event_id>\n<action>0</action>\n<location>aaaaaaa1111.a111.bb.ccc</location>\n</originator>\n<target resource\="5"><object></object></target>\n<data>\n<audit event\="Start"/>\n</data>\n</event>

    There is a way to make this change?

    Thanks,
    Claudio

    ------------------------------
    Claudio Laganà
    ------------------------------


  • 2.  RE: Audit log format

    Posted 06/03/21 05:28 AM
    Edited by Jon Harry 06/03/21 05:28 AM
    Hi Claudio,

    Looking at the two log examples you've provided, it looks as though the first one is from our AAC Runtime and the second is from our Reverse Proxy.  If Arcsight is expecting the second format, perhaps you're sending the wrong audit logs?

    If your issue is that you want to receive logs from AAC Runtime in the same format as those from the Reverse Proxy, I don't think that it's possible to change the format of our audit messages.  In that case, I would have thought that it was usual for the SIEM solution to perform required mapping for received messages (rather than expecting product to output logs in some prescribed format).  IBM's QRadar SIEM certainly has this capability.  It has a DSM for each supported source with the rules required to process audit entries from that source.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: Audit log format

    Posted 06/03/21 09:41 AM
    Hi Jon,
    thanks for your answer.

    I have already replied this way to the ArcSight team too, to be sure I wanted confirmation from the community. :)

    Just a curiosity, to send the WebSEAL (reverse Proxy) logs in that format just insert these entries in the configuration file, for example:
    [logging]
    server-log-cfg = file path = msg__webseald-default.log, hi_water = 1, flush_interval = 20, rollover_size = 90000000, max_rollover_files = 20

    [aznapi-configuration]
    logcfg = http.clf: stdout hi_water = 1, flush_interval = 1, queue_size = 50
    logcfg = http.clf: file path = request.log, flush = 10, rollover = 1000000, max_rollover_files = 10, log = request, buffer_size = 8192, queue_size = 48, log_id = request
    ?

    Thanks a lot,
    Claudio

    ------------------------------
    Claudio Laganà
    ------------------------------

    Original Message


Related Content