XMA: Send XMA messages to SIEM via HPE SSL proxy

XMA: Send XMA messages to SIEM via HPE SSL proxy

Step 1: initiate an HPE SSL proxy if the HPE SSL Proxy is not running
- Mode: PROXYC
- SUBNET: the name of the TCPIP stack
- PORT: HPE SSL proxy client port, this is the same as the port specified next to the IPALERT_PORT entry in the FILTER definition.
- TARGETHOST: DNS or IP address of SSL-enable SIEM (or SSL server)
- TARGETPORT: the port number on where the SSL-enabled SIEM (or SSL server) is listening
Example of a command to initiate an HPE SSL proxy
$SYSTEM.ZNSSSL.SSLOBJ /TERM <term-eg-$VHS>, IN <in-eg-$VHS>, OUT <out-eg-$VHS, NAME <$ssh-name>,NOWAIT/ PROXYC;
SUBNET <tcpip-stack-eg-$ZTC0>;
PORT <IPALERT-PORT-eg-23456>;
TARGETHOST <DNS-or-IP-Address-SSL-enabled-SIEM>;
TARGETPORT <SSL-port-on-where-SIEM-listening-eg-8088>;
IPMODE <ip-mode-eg-IPV4>;
LOGFILE <ssl-log-file-name>;
LOGLEVELFILE <ssl-log-level>;
LOGEMS <ssl-log-EMS-collector>;
LOGLEVELEMS <ssl-log-EMS-level>;
LOGCONSOLE *

Step 2: add a FILTER definition to send plain text SYSLOG alerts on a port that an HPE SSL proxy (SSL client) is listening on.
- IPALERT_ADDRESS 127.0.0.1
- IPALERT_PORT: < HPE SSL proxy client port >
Example of a FILTER definition for an EMS Mover to send plain text SYSLOG alerts on a port that an HPE SSL proxy (SSL client) is listening on.
FILTERDEFBEGIN $EXAMPLE-FILTER-HPE-SSL
 STATUS ACTIVE
 EVALUATE_MSG CONTINUE
 MOVER_BEGIN
   MOVER_SELECT_BEGIN
     PRODUCT = EMS
   MOVER_SELECT_END
 MOVER_END
 DATA_BEGIN
   DATA_SELECT_BEGIN
     FILTERTYPE STRINGFILTER
     INSTALL.LOCATION = $0
   DATA_SELECT_END   
 DATA_END
 ACTIONCOLL_BEGIN
  ACTION_BEGIN
    ACTIONTYPE SYSLOGQ
    !== the ip address of the local system where HPE SSL proxy client resides
    IPALERT_ADDRESS 127.0.0.1
       !== the port number where HPE SSL proxy is listening on
    IPALERT_PORT    23456
    IPALERT_MSGDELIMITER CR
    IPALERT_PREFIX <130> XMA OVER HPE SSL
    ALERTSTRING |{substr(AUDIT.RECORDLCT,1,10)}|T
    ALERTSTRING |{substr(AUDIT.RECORDLCT,12,12))|
    ALERTSTRING XMA_EXAMPLE
    ALERTSTRING |(INSTALL.SYSTEMNAME)|
    ALERTSTRING AUDIT.MESSAGEID:|(AUDIT.MESSAGEID)|
    ALERTSTRING AUDIT.OBJECTTYPE:|(AUDIT.OBJECTTYPE)|
    ALERTSTRING AUDIT.OPERATION:|(AUDIT.OPERATION)|
    ALERTSTRING AUDIT.RESULT:|(AUDIT.RESULT)|
   ACTION_END
ACTIONCOLL_END
FILTERDEFEND

Step 3: run the XMA_FILTERS_CHECK and XMA_COMPILE_FILTERS macro to update the MACONFB file.

Step 4: Restart the SLSENDER through the XMA_MANAGER macro
e.g. 2: Movers -> 21: Maintain Administrative Servers -> 3: Stop SLSENDER -> 3: Start SLSENDER

Step 5: Validate the date-time value on the ALERTEDGMT column in the SYSLOGQ table.
The XMA Mover uses '1970-01-01:00:00:00.000000' as a date-time value when it inserts the plain text SYSLOG alerts into the SYSLOGQ table.
The XMA SLSENDER updates the date-time value to the current date-time after successfully sending the SYSLOG alerts to the HPE SSL proxy client
Below is an example of the SQL Statement - validate the date on the ALERTEDGMT is not 1970-01-01;
select cast(entrygmt as date),cast(alertedgmt as date),target_host,target_port,count (*)
from syslogq
group by 1,2,3,4
order by 1,2,3,4
for browse access;

    • Related Articles

    • XMA: Can XMA movers send data off-box to a SIEM?

      Question: Can Merged Audit (XMA) movers send data to a SIEM (off-box) or is SLSENDER the only mover that can do this? Answer: With a filter configured with an ACTIONTYPE of SYSLOGQ, movers add audit events for products (e.g. XAC, XUA, Safeguard, EMS, ...

    • XMA: SLSENDER Error unable to send messages to host.

      The SYSLOGQ database table in the XMADAT subvolume has 2 columns that can be used to determine if messages are being sent to the SIEM. ENTRYGMT is the timestamp when the message was inserted into the queue by a mover. ALERTEDGMT is the timestamp when ...

    • XMA: SEND_STATUS values and its meaning

      Starting XMA 2.70, SEND_STATUS should be used instead since ALERTEDGMT is not the important indication of whether messages were sent to the SIEM successfully. For example, the below query returns the number of records sent to the SIEM, sorted by ...

    • XMA: Sending Syslog messages from XMA to 2 SIEM with a single filter define

      To send Syslog messages to 2 SIEM, it's required to have two ACTION having each one set with one of the SIEM IP Address. ACTIONCOLL_BEGIN ACTION_BEGIN ACTIONTYPE IPALERT ! SYSLOGQ .... IPALERT_ADDRESS <IP Address-A> .... ACTION_END ACTION_BEGIN ...

    • Steps to Fully Setup XTR With HPE SSL

      1. Setup HPESSL When prompted by the SETUP macro, select a listening port and enter it and your XTR port as the target port. For details on running the SETUP macro, see "To install a HPE NonStop SSL PROXYS process for RSC" (beginning on step 3, run ...