Share public, unparsed data with third-party applications. Message Forwarding rules create public copies of raw data on the Data Streaming Bus. You use authentication certificates and Apache Kafka® code to access the raw data. The use of dedicated authentication certificates ensures secure communication.
Your system must include a Data Streaming Bus.
You need a working knowledge of Kafka.
You need to know the names of the topics you want to consume.
Get a ca_root_certificate file from Trellix.
If your system does not include a Trellix Enterprise Log Search device, enable data routing on the Receivers you want to collect data from ( → ).
You set up Message Forwarding by creating a rule for each topic you want to forward. Rules specify the sources, topics, and authentication certificates for the topics. Status flags appear to the left of each rule that indicate data source health and certificate life span.
From the Trellix ESM dashboard, click
.png "menu.png")
.Select Message Forwarding.
The Message Forwarding Rules page appears.
Click Add.
Type a rule name and select Enabled.
Choose the Source Adapter for the rule. ELS Raw Log retrieves raw data from the ELS. Data Routing retrieves raw data from data sources that have data routing enabled.
Note
Once you enable data routing on a Receiver, you can enable and disable it on individual data sources ( → ).
If you want topics from a data source to be consumed only by the third-party Kafka consumer and not parsed, deselect Parsing ( → ).
Select the Devices you want to collect data from. To select all data sources on a Receiver, select the Receiver.
Type a Target topic name.
Select an existing Authentication certificate or create (Create Certificate) and download a new certificate for the rule.
Note
Once a certificate is generated, you have 10 minutes to download it before it expires.
Important
If your browser is not configured to automatically download files, manually download the certificate.
Use the DSB IP address/port, both certificates, and the public topic names when you configure your Kafka consumer.