Before you begin, you'll need:
A standard up-to-date *nix machine.
Java 7 virtual machine.
To complete the installation:
Copy the
SIEMAgent.jarfile included with the manual to/opt/adallom/siemagent/SIEMAgent.jarNote
Adallom supports multiple concurrent SIEM agents for different variations of logs and filters. You can simply create several configuration files and repeat the following steps.
Note
Adallom uses TCP syslog to assure reliability of the integration. TCP Syslog listener is installed by default on SIEM, however, if your SIEM instance does not support TCP Syslog, but does support UDP, contact support@adallom.com.
Configure the SIEM Agent by creating the file
/opt/adallom/siemagent/cfg/CFGNAME.xml.Refer to the tables below to fill in the following settings:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <config> <logDirectory>/var/log/adallom/siemagent/state/CFGNAME.dat</logDirectory> <stateFilePath>/opt/adallom/siemagent/state/CFGNAME.dat</stateFilePath> <rerunDelay>RUN INTERVAL</rerunDelay> <url>https://console.adallom.com/api/</url> <token>TOKEN</token> <api>LOG TYPE</api> <filters> <filter>FILTER</filter> <filter>FILTER</filter> . . . </filters> <syslogHost>SIEM HOST<syslogHost> <syslogPort>SIEM PORT<syslogPort> <proxyHost>OPTIONAL - PROXY HOST</proxyHost> <proxyPort>OPTIONAL - PROXY PORT</proxyPort> <loggingEnable>OPTIONAL - LOGGING ENABLE</loggingEnable> <includeHeader>OPTIONAL - INCLUDE HEADER</includeHeader> </config>Settings
Name
Description
Example
CFGNAME
A unique name which describes this instance of SIEMAgent.
auditsgrabber
RUN INTERVAL
The interval for synchronization with Adallom in milliseconds. Recommended value is 20 seconds.
20000
TOKEN
The token that was generated in Getting Your Adallom API Token.
f4b40d0cd330f53c77f57b50446c380c4670f9a4
LOG TYPE
Type of logs to retrieve. Supported values:
Audits - Activity log entries
Alerts - Alert entries
audits
FILTER
Optional
List of filters. Only entries that conform to all the filters are processed (AND filter).
Different filter options are specified in Alert filters.
service=google-apps
SIEM HOST
The IP address of the SIEM
10.0.0.120
SIEM PORT
The port number for TCP Syslog listener
1111
PROXY HOST
Optional
The IP address of the proxy.
10.0.0.250
PROXY PORT
Optional
The TCP port of the proxy.
8080
LOGGING ENABLE
Optional
Set to true to activate the logs.
true
INCLUDE HEADER
Optional
Set to true to trim the CEF header.
true
Parameters
Parameter Name
Type
Description
Action
Action Multi-value strings
Supports negation
List of action names (returned from
/api/audits/type/)Service
Multi-value strings
Supports negation
List of service “slugs” (safe URL strings) of service names to filter the results
User
Multi-value strings
Supports negation
List of users to filter the results
Alert filters
Parameter Name
Type
Description
Users
Comma separated list
Supports negation
List of users to filter the results
Execute the SIEM Agent. The Adallom SIEM Agent supports two run modes:
Run in command line mode:
java -jar SIEMAgent.jar /opt/adallom/siemagent/cfg/CFGNAME.xmlRecommended: Running as a Java daemon. Configure common-daemons with these settings:
Daemon class: com.adallom.AdallomDaemon