Log Forwarding - Security Events and Traffic Logs¶
Overview¶
Security Information Event Management (SIEM) systems are solutions that specialize in combining security information and security event information together into a single management platform. The security and event information will originate from 3rd party security solutions that are configured to forward this information to the SIEM.
Valtix supports viewing security event information directly within the UI. These events are available under the Investigate -> Flow Analytics section. The events are categorized and viewable as follows:
Category | Type | Description |
---|---|---|
Flow Logs | FLOW_LOG | Information related to the different stages of a traffic flow |
Firewall Events | APPID | Traffic matched based on Application ID (OpenAppID) |
GEOIP | Traffic sourced from or destined to a Geo IP (MaxMind) | |
L4_FW | Traffic matched based on layer4 information (Source/Dest IP/Port and Protocol) | |
MALICIOUS_IP | Traffic sourced from or destined to a malicious IP (Trustwave) | |
SNI | Traffic matched based on SNI information | |
Network Threats | AV | Traffic where a virus has been detected (ClamAV) |
DPI | Traffic where an IDS/IPS threat has been detected (TALOS) | |
DLP | Traffic where sensitive data is being exfiltration | |
Web Protection | WAF | Traffic where a web application threat has been detected (ModSecurity) |
L7DOS | Traffic that is contributing to a layer7 DOS attack | |
URL Filtering | URLFILTER | Traffic that matches a URL category or URL (BrightCloud) |
FQDN Filtering | FQDNFILTER | Traffic that matches a FQDN category or FQDN (BrightCloud) |
HTTPS Logs | HTTP_REQUEST | Information related to web-based traffic (HTTP) |
TLS_ERROR | Information related to TLS errors | |
TLS_LOG | Information related to TLS behavior | |
Traffic Summary Logs | SESSION_SUMMARY | Summary information on each processed traffic session |
Tech Notes
Flow Logs are deprecated in 2.10 and later Gateway releases. The information contained within each Flow Log is made available as part of the session information available in Traffic Summary -> Logs.
Each of the event categories can be sent to a SIEM using a Log Forwarding Profile. The SIEMs currently supported by Valtix are:
A Log Forwarding Profile can be operated on using the steps outlined below:
Standalone Profile¶
Create a Profile¶
- Navigate to Manage -> Profiles -> Log Forwarding
- Click Create
- Specify a Profile Name and Description
- Specify Type as Standalone
- Fill in the appropriate parameters (refer to the SIEM-specific documentation)
- Click Save
- Add the desired Gateway Associations (refer to Add a Gateway Association)
Edit a Profile¶
- Navigate to Manage -> Profiles -> Log Forwarding
- Check the box next to the Profile you want to Edit
- Click Edit
- Modify the parameters as desired (refer to the SIEM-specific documentation)
- Click Save
Group Profile¶
Create a Profile¶
- Navigate to Manage -> Profiles -> Log Forwarding
- Click Create
- Specify a Profile Name and Description
- Specify Type as Group
- Add a row for to associate a Standalone Profile
- Click Save
- Add the desired Gateway Associations (refer to Add a Gateway Association)
Edit a Profile¶
- Navigate to Manage -> Profiles -> Log Forwarding
- Check the box next to the Profile you want to Edit
- Click Edit
- Modify, Add or Remove Standalone Profiles
- Click Save
Delete a Profile¶
- Navigate to Manage -> Profiles -> Log Forwarding
- View the Profile Details to view the Associated Gateways
- Remove all Gateway Associations (refer to Remove a Gateway Association)
- Navigate to Manage -> Profiles -> Log Forwarding
- Check the box next to the Profile you want to Delete
- Click Delete
- Confirm the Delete operation by clicking Yes or No
View a Profile Details¶
- Navigate to Manage -> Profiles -> Log Forwarding
- Select the Profile link you want to view the Details
- View the Details information
Add a Gateway Association¶
- Navigate to Manage -> Gateways -> Gateways
- Check the box next the Gateway you want to associate the Profile
- Click Edit
- For the Log Profile parameter, select the desired Profile from the menu
- Click Save
Remove a Gateway Association¶
- Navigate to Manage -> Gateways -> Gateways
- Check the box next the Gateway you want to de-associate the Profile
- Click Edit
- For the Log Profile parameter, click the 'X' next to the Profile to remove it
- Click Save
Tech Notes
A Log Forwarding Profile can also be associated with a Gateway at time of Gateway creation. The Log Profile parameter is available during the Gateway creation process, where the desired Profile can be selected from the menu.