Syslog Integration (SIEM)

Vulnerability ProtectionDeep Security can forward events to a syslog server, using these formats:

• Common Event Format 1.0: A format sponsored by ArcSight (www.arcsight.com)
• Log Event Extended Format (LEEF) 2.0: A format used for integration with IBM QRadar
• Basic Syslog format: Some modules support a Basic Syslog format; however, these formats are made available for legacy installations and should not be used for new Syslog integration projects.

Syslog messages will only be sent for the events selected on the System Events tab. Other event types can be configured for syslog notification from the policy editor or computer editor.

Setting up a Syslog on Red Hat Enterprise Linux 6 or 7

The following steps describe how to configure rsyslog on Red Hat Enterprise Linux 6 or 7 to receive logs from Vulnerability ProtectionDeep Security.

1. Log in as root
2. Execute:
   vi /etc/rsyslog.conf
3. Uncomment the following lines near the top of the rsyslog.conf to change them from:
   
   #$ModLoad imudp
#$UDPServerRun 514

#$ModLoad imtcp
#$InputTCPServerRun 514

to
   
   $ModLoad imudp
$UDPServerRun 514

$ModLoad imtcp
$InputTCPServerRun 514


4. Add the following two lines of text to the end of the rsyslog.conf:
   • #Save Vulnerability ProtectionDeep Security Manager logs to VPM.logDSM.log
   • Local4.* /var/log/VPM.logDSM.log
5. Save the file and exit
6. Create the /var/log/VPM.logDSM.log file by typing touch /var/log/VPM.logDSM.log
7. Set the permissions on the VPMDSM log so that syslog can write to it
8. Save the file and exit
9. Restart syslog:
   • On Red Hat Enterprise Linux 6: service rsyslog restart
   • On Red Hat Enterprise Linux 7: systemctl restart rsyslog

When Syslog is functioning you will see logs populated in: /var/log/VPM.logDSM.log

Setting up a Syslog on Red Hat Enterprise Linux 5

The following steps describe how to configure Syslog on Red Hat Enterprise Linux to receive logs from Vulnerability ProtectionDeep Security.

1. Log in as root
2. Execute:
   vi /etc/syslog.conf
3. Add the following two lines of text to the end of the syslog.conf :
   • #Save Vulnerability ProtectionDeep Security Manager logs to VPM.logDSM.log
   • Local4.* /var/log/VPM.logDSM.log
4. Save the file and exit
5. Create the /var/log/VPM.logDSM.log file by typing touch /var/log/VPM.logDSM.log
6. Set the permissions on the VPMDSM log so that syslog can write to it
7. Execute:
   vi /etc/sysconfig/syslog
8. Modify the line " SYSLOGD_OPTIONS " and add a " -r " to the options
9. Save the file and exit
10. Restart syslog: /etc/init.d/syslog restart

When Syslog is functioning you will see logs populated in: /var/log/VPM.logDSM.log

Manager Settings

You can configure Vulnerability ProtectionDeep Security Manager to instruct all managed computers to send logs to the Syslog computer, or you can configure individual computers independently.

To configure the Manager to instruct all managed computers to use Syslog:

1. Go to the Administration > System Settings > SIEM tab.
2. In the System Event Notification (from the Manager) area, set the Forward System Events to a remote computer (via Syslog) option.
3. Type the hostname or the IP address of the Syslog computer.
4. Enter which UDP port to use (usually 514).
5. Select which Syslog Facility to use (Local4 from the Red Hat example above.)
6. Select which Syslog Format to use.

You have now configured the Vulnerability ProtectionDeep Security Manager to instruct all existing and new computers to use remote Syslog by default.

There are two options for where the syslog messages are sent from. The first option (Direct Forward) sends the messages in real time directly from the Agents or Virtual Appliances. The second option (Relay via the Manager) sends the syslog messages from the Manager after events are collected on heartbeats. The option to send from the Manager may be desirable if the destination licenses based on the number of sources.

If the syslog messages are sent from the Manager, there are several differences. In order to preserve the original hostname (the source of the event), a new extension ("dvc" or "dvchost") is present. "dvc" is used if the hostname is an IPv4 address; "dvchost" is used for hostnames and IPv6 addresses. Additionally, the extension "TrendMicroDsTags" is used if the events are tagged (This applies only to auto-tagging with run on future, since events are forwarded via syslog only as they are collected by the Manager). The product for logs relayed through the Manager will still read "Vulnerability ProtectionDeep Security Agent"; however, the product version is the version of the Manager.

All CEF events include dvc=IPv4 Address or dvchost=Hostname (or the IPv6 address) for the purposes of determining the original source of the event. This extension is important for events sent from a Virtual Appliance or the Manager, since in this case the syslog sender of the message is not the originator of the event.

This default setting can be overridden for specific Policies and on individual computers. To override on a computer, find the computer you want to configure, open the Computer Editor and go to Settings and click the SIEM tab. Like many other settings on a computer, you can instruct it to inherit default settings, or override them. To instruct this computer to ignore any inheritable default settings, select the Forward Events To option and enter the details for a different syslog server, or to not forward logs at all. Follow the same procedure to override the setting on a Policy.

Parsing Syslog Messages (CEF)

Base CEF format: CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension

To determine whether the log entry comes from the Vulnerability ProtectionDeep Security Manager or a Vulnerability ProtectionDeep Security Agent, look at the "Device Product" field:

Sample CEF Log Entry: Jan 18 11:07:53 vpmhostdsmhost CEF:0|Trend Micro|Vulnerability ProtectionDeep Security Manager|<DSM version>2.0|600|Administrator Signed In|4|suser=Master...

To further determine what kind of rule triggered the event, look at the "Signature ID" and "Name" fields:

Sample Log Entry: Mar 19 15:19:15 chrisds7 CEF:0|Trend Micro|Vulnerability ProtectionDeep Security Agent|<DSA version>2.0|123|Out Of Allowed Policy|5|cn1=1...

The following "Signature ID" values indicate what kind of event has been triggered:

Parsing Syslog Messages (LEEF 2.0)

Base LEEF 2.0 format: LEEF:2.0|Vendor|Product|Version|EventID|(Delimiter Character, optional if the Delimiter Character is tab)|Extension

Sample LEEF 2.0 Log Entry (DSM System Event Log Sample): LEEF:2.0|Trend Micro|Deep Security Manager|9.6.2007|192|cat=System name=Alert Ended desc=Alert: CPU Warning Threshold Exceeded\nSubject: 10.201.114.164\nSeverity: Warning sev=3 src=10.201.114.164 usrName=System msg=Alert: CPU Warning Threshold Exceeded\nSubject: 10.201.114.164\nSeverity: Warning TrendMicroDsTenant=Primary

Events Originating in the Manager

System Event Log Format

Base CEF Format: CEF:Version|Device Vendor|Device Product|Device Version|Signature ID|Name|Severity|Extension

Sample CEF Log Entry: CEF:0|Trend Micro|Vulnerability ProtectionDeep Security Manager|<DSM version>2.0|600|User Signed In|3|src=10.52.116.160 suser=admin target=admin msg=User signed in from fe80:0:0:0:2d02:9870:beaa:fd41

Base LEEF 2.0 format: LEEF:2.0|Vendor|Product|Version|EventID|(Delimiter Character, optional if the Delimiter Character is tab)|Extension

Sample LEEF 2.0 Log Entry: LEEF:2.0|Trend Micro|Deep Security Manager|9.6.2007|192|cat=System name=Alert Ended desc=Alert: CPU Warning Threshold Exceeded\nSubject: 10.201.114.164\nSeverity: Warning sev=3 src=10.201.114.164 usrName=System msg=Alert: CPU Warning Threshold Exceeded\nSubject: 10.201.114.164\nSeverity: Warning TrendMicroDsTenant=Primary

Events Originating in the Agent

See also:

• Policies, Inheritance and Overrides