FairWarning configuration

Prerequisites

To integrate FairWarning data into Trellix, you must have the following:

An active enforced policies set up in their FairWarning environment
A Communications Broker in place to receive the daily files from FairWarning

To configure FairWarning to send daily SIEM files to Trellix, follow these steps:

FairWarning creates these directories on the FairWarning appliance:
```
/chroot/data/siem/fireEye
/etc/syslog-ng/cert.d
```
FairWarning copies the Fairwarning “wildcard” certificate to the /etc/syslog-ng/cert.d directory.
FairWarning provides the private key and wildcard certificate to Trellix to install the SSL files on the Helix Enterprise Comm Broker.
The customer must provide the IP address of the Helix Enterprise Comm Broker to their Software Implementation Manager.
FairWarning's IP address must be provided to the Trellix administrator for Comm Broker setup.

FairWarning then adds the following file to the FairWarning appliance under /etc/syslog-ng/ syslog-ng.conf, inserting the IP address in the highlighted area:

# syslog-ng configuration file,
options {
    flush_lines (0);
    keep_hostname (yes) 
    time_reopen (10);
    log_fifo_size (1000);
    long_hostnames (off);
    use_dns (no);
    use_fqdn (no);
    create_dirs (no);
    keep_hostname (yes);
};

source s_siem { 
    file("/chroot/data/siem/fireEye" flags(no-parse, validate-utf8));
};

source s_sys {
    file ("/proc/kmsg" program_override("kernel: "));
    unix-stream ("/dev/log");
    internal();
    # udp(ip(0.0.0.0) port(514));
};

destination d_cons { file("/dev/console"); };
destination d_mesg { file("/var/log/messages"); };
destination d_auth { file("/var/log/secure"); };
destination d_mail { file("/var/log/maillog" flush_lines(10)); };
destination d_spol { file("/var/log/spooler"); };
destination d_boot { file("/var/log/boot.log"); };
destination d_cron { file("/var/log/cron"); };
destination d_kern { file("/var/log/kern"); };
destination d_mlal { usertty("*"); };
destination d_fireeye { tcp ("COMMBROKER IP" port (514) tls(ca_dir("/etc/syslog-ng/cert.d")) );};
filter f_kernel { facility(kern); };

filter f_default    { level(info..emerg) and        
     not (facility(mail)
     or facility(authpriv)
     or facility(cron));
};

filter f_auth       { facility(authpriv); };
filter f_mail       { facility(mail); };
filter f_emergency  { level(emerg); };
filter f_news       {
    facility(uucp) or
    (facility(news) 
     and level(crit..emerg));
};
          
filter f_boot   { facility(local7); };	
filter f_cron   { facility(cron); };	
            
#log { source(s_sys); filter(f_kernel); destination(d_cons); };
log { source(s_sys); filter(f_kernel); destination(d_kern); };
log { source(s_sys); filter(f_default); destination(d_mesg); };
log { source(s_sys); filter(f_auth); destination(d_auth); };
log { source(s_sys); filter(f_mail); destination(d_mail); };
log { source(s_sys); filter(f_emergency); destination(d_mlal); };
log { source(s_sys); filter(f_news); destination(d_spol); };
log { source(s_sys); filter(f_boot); destination(d_boot); };
log { source(s_sys); filter(f_cron); destination(d_cron); };
log { source(s_siem); destination(d_fireeye); };
log { source(s_cef); destination(d_fireeye); };

Within FairWarning, set up the following Task Schedule:

Once the Comm Broker has been set up to accept the files, a test file should be sent to validate connectivity.