** Please read before beginning this procedure **
1.This procedure assumes that the Log Adapter (LAF) filters have already been installed.
If they have not been installed, this procedure cannot be performed. If this is the
case, please see the section "Installing the SIEM Log Adapter" in Chapter 3, "Installing
XMA" of the XYGATE Merged Audit (XMA) Reference Manual before attempting to modify
the LAF filters.
2. Prior to starting an XMA upgrade or re-install, a copy of the LAFARC/ LAFCEF file must be
saved. This is because the existing LAFARC/LAFCEF file will be overwritten by the
upgrade/reinstall process and any modifications lost. On completion of the
upgrade/reinstall, the copy can be used to replace the LAFARC/LAFCEF file created at
upgrade/reinstall time. XMA_EDIT_FILTERS can be used to syntax-check, compile and
install the filters.
--------------------------------------------------------------------------------------------------
Starting with XMA version 2.60, the Log Adapter filters (LAF) files are called LAFCEF instead of LAFARC. The only difference between the two is the use of the three letters ARC (pre XMA 2.60) instead of CEF (XMA 2.60 and later).
1. Save a copy of the existing FILTERS and LAFARC/LAFCEF files. Volume to the XYGATEMA installation
subvolume and:
Example:
a. FUP DUP LAFCEF, OLAFCEF, SAVEALL
b. FUP DUP FILTERS, OFILTERS, SAVEALL
2. Using the XMA_EDIT_FILTERS macro, edit the FILTERS file
a. run $<vol>.xygatema.xma install (where $<vol> is the disk volume where XMA is installed)
b. xma_edit_filters
3. Find the CEF/ArcSight Log Adapter Filter section at or near the bottom of the FILTERS file
Example:
! Begin CEF Log Adapter Filters - Version 1.00
#DEFINE ^CEF_STATUS ACTIVE
#DEFINE_BEGIN ^CEF_ACTIONTYPE
! TCP
ACTIONTYPE SYSLOGQ
IPALERT_MSGDELIMITER CR
#DEFINE_END
#DEFINE_BEGIN ^CEF_ROUTING
IPALERT_ADDRESS 10.1.1.62
IPALERT_PORT 514
IPALERT_IPPROCESS $ZTC0
#DEFINE_END
#INCLUDE \CHICAGO.$VTDW8.XMA260.LAFCEF
! End CEF Log Adapter Filters
4. Copy the lines represented by the purple lines above. Paste them between the #DEFINE_END and #INCLUDE
lines at the bottom of this section:
--------------------------------
Sample CEF Log Adapter Filters after the lines are pasted, but before any changes. The green text
represents the pasted lines.
! Begin CEF Log Adapter Filters - Version 1.00
#DEFINE ^CEF_STATUS ACTIVE
#DEFINE_BEGIN ^CEF_ACTIONTYPE
! TCP
ACTIONTYPE SYSLOGQ
IPALERT_MSGDELIMITER CR
#DEFINE_END
#DEFINE_BEGIN ^CEF_ROUTING
IPALERT_ADDRESS 10.1.1.62
IPALERT_PORT 514
IPALERT_IPPROCESS $ZTC0
#DEFINE_END
#DEFINE_BEGIN ^CEF_ROUTING
IPALERT_ADDRESS 10.1.1.62
IPALERT_PORT 514
IPALERT_IPPROCESS $ZTC0
#DEFINE_END
#INCLUDE \CHICAGO.$VTDW8.XMA260.LAFCEF
! End CEF Log Adapter Filters
--------------------------------
5. Make the following changes to the copied lines:
a. Change the filter name of the #DEFINE BEGIN for the pasted lines to something different. Adding a
number or letter on the end to make it unique is the easiest option.
Example:
#DEFINE_BEGIN ^CEF_ROUTING2
b. Change the IPALERT_ADDRESS in the copied section to the ip address or DNS name of the second
SIEM:
Example:
IPALERT_ADDRESS 10.177.110.55
c. Change the IPALERT_PORT to the port number for the second SIEM:
IPALERT_PORT 2345
After the copy and changes, the modified CEF Log Adapter Filters section should look similar to this:
! Begin CEF Log Adapter Filters - Version 1.00
#DEFINE ^CEF_STATUS ACTIVE
#DEFINE_BEGIN ^CEF_ACTIONTYPE
! TCP
ACTIONTYPE SYSLOGQ
IPALERT_MSGDELIMITER CR
#DEFINE_END
#DEFINE_BEGIN ^CEF_ROUTING
IPALERT_ADDRESS 10.1.1.62
IPALERT_PORT 514
IPALERT_IPPROCESS $ZTC0
#DEFINE_END
#DEFINE_BEGIN ^CEF_ROUTING2
IPALERT_ADDRESS 10.177.110.55
IPALERT_PORT 2345
IPALERT_IPPROCESS $ZTC0
#DEFINE_END
#INCLUDE \CHICAGO.$VTDW8.XMA260.LAFCEF
! End CEF Log Adapter Filters
The Log Adapter Filter section should now have two #DEFINES subsections - one for each SIEM
Once the Log Adapter Filter section has been modified for the second SIEM, save the changes and exit the file.
6. Edit the LAFCEF or LAFARC file. Each individual filter in the file will be identified with the text
FILTERDEFBEGIN in its first line and FILTERDEFEND as its last line:
Sample Filter:
FILTERDEFBEGIN $CEF-BASE24-CATCHALL
STATUS ^CEF_STATUS ! $BASE24-CATCHALL
EVALUATE_MSG CONTINUE
MOVER_BEGIN
MOVER_SELECT_BEGIN
PRODUCT = BASE24
MOVER_SELECT_END
MOVER_END
DATA_BEGIN
DATA_SELECT_BEGIN
FILTERTYPE NOFILTER
DATA_SELECT_END
DATA_END
ACTIONCOLL_BEGIN
ACTION_BEGIN
ACTIONTYPE SETDATA
AUDIT.USER_DATA BASE24-CATCHALL
ACTION_END
ACTION_BEGIN
^CEF_ACTIONTYPE
^CEF_ROUTING
IPALERT_PREFIX <TDW1>
ALERTSTRING CEF:0|XYPRO|NONSTOP|XMA|BASE24-CATCHALL|BASE24-CATCHALL|5|
^CEF_ALERTSTRINGS
ACTION_END
ACTIONCOLL_END
FILTERDEFEND
7. Each filter in the file will need to be modified to include a second ACTION_BEGIN / ACTION_END section for ^CEF_ROUTING2 / ^ARC_ROUTING2 in order to send the same data to a second SIEM. The name of the define in the second action should match name of the second #DEFINE_BEGIN specified in step 4a above. In this example, the second routing define would be called ^CEF_ROUTING2.
Sample filter before modifications:
FILTERDEFBEGIN $CEF-BASE24-CATCHALL
STATUS ^CEF_STATUS ! $BASE24-CATCHALL
EVALUATE_MSG CONTINUE
MOVER_BEGIN
MOVER_SELECT_BEGIN
PRODUCT = BASE24
MOVER_SELECT_END
MOVER_END
DATA_BEGIN
DATA_SELECT_BEGIN
FILTERTYPE NOFILTER
DATA_SELECT_END
DATA_END
ACTIONCOLL_BEGIN
ACTION_BEGIN
ACTIONTYPE SETDATA
AUDIT.USER_DATA BASE24-CATCHALL
ACTION_END
ACTION_BEGIN
^CEF_ACTIONTYPE
^CEF_ROUTING
IPALERT_PREFIX <TDW1>
ALERTSTRING CEF:0|XYPRO|NONSTOP|XMA|BASE24-CATCHALL|BASE24-CATCHALL|5|
^CEF_ALERTSTRINGS
ACTION_END
ACTIONCOLL_END
FILTERDEFEND
Sample filter after modifications:
The green text represents the copied lines for the second action.
FILTERDEFBEGIN $CEF-BASE24-CATCHALL
STATUS ^CEF_STATUS ! $BASE24-CATCHALL
EVALUATE_MSG CONTINUE
MOVER_BEGIN
MOVER_SELECT_BEGIN
PRODUCT = BASE24
MOVER_SELECT_END
MOVER_END
DATA_BEGIN
DATA_SELECT_BEGIN
FILTERTYPE NOFILTER
DATA_SELECT_END
DATA_END
ACTIONCOLL_BEGIN
ACTION_BEGIN
ACTIONTYPE SETDATA
AUDIT.USER_DATA BASE24-CATCHALL
ACTION_END
ACTION_BEGIN
^CEF_ACTIONTYPE
^CEF_ROUTING
IPALERT_PREFIX <130>
ALERTSTRING CEF:0|XYPRO|NONSTOP|XMA|BASE24-CATCHALL|BASE24-CATCHALL|5|
^CEF_ALERTSTRINGS
ACTION_END
ACTION_BEGIN
^CEF_ACTIONTYPE
^CEF_ROUTING2
IPALERT_PREFIX <130>
ALERTSTRING CEF:0|XYPRO|NONSTOP|XMA|BASE24-CATCHALL|BASE24-CATCHALL|5|
^CEF_ALERTSTRINGS
ACTION_END
ACTIONCOLL_END
FILTERDEFEND
The ^CEF_ROUTING for the copied lines was modified to use ^CEF_ROUTING2. A second ACTION_BEGIN / ACTION_END section that uses ^CEF_ROUTING2 will need to be added to every filter in the LAFCEF / LAFARC file.
8. When all modifications are complete, the FILTERS and LAFCEF/LAFARC files should be syntax-checked,
compiled and loaded using the XMA_EDIT_FILTERS macro.
XMA_EDIT_FILTERS
Enter "E" at the * prompt to exit.
The macro will proceed to syntax check the FILTERS and the LAFCEF / LAFARC files. If no errors are
found, the macro will prompt the user to install the new filters.
9. Confirm the record counts to each SIEM:
a. Load the XMA defines. From a TACL:
XMA_LOAD_DEFINES
b. Execute the query. Do not include the red text in your query.
SET LIST_COUNT 0;
SELECT TARGET_HOST, TARGET_PORT, COUNT(*)
FROM =XMA_SYSLOGQ
WHERE ENTRYGMT > TIMESTAMP "2022-01-24:00:00:00.000000" <--Substitute whatever date that you need in order to check the records in the SYSLOGQ table
GROUP BY TARGET_HOST, TARGET_PORT
BROWSE ACCESS;
DETAIL
COL 1 as C0.20 heading "Target IP",
COL 2 heading "Target Port",
COL 3 heading "Count";
LIST ALL;
The above SQL query statements can be placed in an obey file and executed from SQLCI as an obey file.
If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.
Related Articles
XMA: How to modify FILTERS file to write to two ArcSight (LAF) devices simultaneously
Note: LAF file and filter names will be referenced as LAFxxx or xxx, where: xxx = ARC (XMA 2.57 and earlier versions) CEF (XMA 2.60 and later versions) If the LAF macro has already been run once to install the ArcSight adapter, the user can do the ...
XMA: Can XMA movers send data off-box to a SIEM?
Question: Can Merged Audit (XMA) movers send data to a SIEM (off-box) or is SLSENDER the only mover that can do this? Answer: With a filter configured with an ACTIONTYPE of SYSLOGQ, movers add audit events for products (e.g. XAC, XUA, Safeguard, EMS, ...
XMA: Send XMA messages to SIEM via HPE SSL proxy
Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running - Mode: PROXYC - SUBNET: the name of the TCPIP stack - PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER ...
XMA: Is additional licensing required to install a log adapter in order to write data to a SIEM?
Whether additional licensing is required by XYPRO depends on the log adapter to be installed. The LAFRSA, LAFRST and LAFXS1 adapters require additional licensing, while the LAFCEF adapter does not. If you are unable to locate the solution needed or ...
XMA: How to optimize SLSENDER to handle multiple SIEMs
SLSENDER must be optimized for the number of SIEMS and transactions 1. SLSENDER can be configured in XMA_MANAGER. >run xma install >XMA_MANAGER >2: Movers >18: Configure SysLog Send server) 2. In the SysLog Send server menu (SLSENDER), the Max Number ...