This guide describes how to integrate beSECURE and Logpoint using the Syslog data exchange method. This method requires you to configure Logpoint to accept incoming Syslog connections from beSECURE, and configure beSECURE to send Syslog information to Logpoint once a scan is complete.


Configuring Logpoint to integrate with beSECURE

To integrate Logpoint with beSECURE, do the following:

  1. Log in to Logpoint.
    Note: If this is the first time you are logging in, the default credentials are admin / changeme.
  2. Select Settings.
  3. Select Repos.
  4. Select Add.
  5. On the ADD REPO dialog, do the following:
    1. In the Repo Name box, enter beSECURE_Report.
    2. In the Retention box, select the number of days you want to keep records. It is recommended for this value to be no less than two dates between consecutive scans. For example, if you run weekly scans, set the value to 15, or if you run monthly scans, set the value to 62. By keeping a record of at least two scans, you can perform a comparison and time analysis on the results.
  6. Select Submit.
  7. Select Log Collection Policies.
  8. Select Add.
  9. On the CREATE LOG COLLECTION POLICY dialog, enter beSECURE_Collection in the Name box.
  10. Select Save.
  11. On the CONFIRMATION dialog, select Yes.
  12. Select Syslog Collector.
  13. On the SYSLOG COLLECTORdialog, do the following:
    1. In the Parser box, select SyslogParser.
    2. In the Processing Policy box, select default.
    3. In the Charset box, select utf_8.
  14. Select Submit.
  15. On the AVAILABLE COLLECTORS FETCHERS dialog, the beSECURE_Collection fetcher will be listed.
  16. You must create a Normalizing Policy to convert the Syslog line into meaningful and searchable data inside Logpoint. To create a policy, do the following:
    1. Select Settings > Knowledge Base > Normalization Packages.
    2. Select Add.
    3. On the NORMALIZATION PACKAGEdialog, do the following:
      1. In the Name box, enter beSECURE.
      2. In the Description box, enter Process incoming beSECURE Syslog entries.
  17. Select Submit.
  18. Select Signatures.
  19. Select Add.
  20. In the Pattern box, enter the following: 
    <id:int> <source_ts:datetime_m> beSECURE beSECURE <process_id:int> - - TestID=<TestID:all>   VulnerabilityName=<VulnerabilityName:all> RiskNo=<RiskFactorValue:all>  RiskText=<RiskFactorName:all> AffectedHost=<AffectedHost:all> AffectedPort=<AffectedPort:all>   AffectedProtocol=<AffectedProtocol:all> CVE=<CVE:all> CVSSScore=<CVSSScore:all>
  21. In the Examplebox, enter the following: 
    <46>1 2017-11-02T00:06:16+01:00 beSECURE beSECURE 6706 - - TestID=<!-- #TestID# -->  VulnerabilityName=<!-- #VulnerabilityName# --> RiskNo=<!-- #RiskFactorValue# --> RiskText=<!--#RiskFactorName# --> AffectedHost=<!-- #AffectedHost# --> AffectedPort=<!-- #AffectedPort# -->  AffectedProtocol=<!-- #AffectedProto# --> CVE=<!-- #CVE# --> CVSSScore=<!-- #CVSSScore# -->
  22. Add a Key Values named norm_id with the value of beSECURE.
  23. Add another with the name label and the value Vulnerability.
  24. Test the pattern and verify the response.
  25. Select Submit.
  26. Add another pattern with the same norm_id Key Value, but without the label of Vulnerability: 
    <id:int> <source_ts:datetime_m> beSECURE beSECURE <process_id:int> - - Scan <job_name:all>   <state:started|completed>
  27. Enter this as an example: 
    <46>1 2017-11-01T17:24:34+01:00 beSECURE beSECURE 23460 - - Scan test completed.
  28. Select Check Pattern to verify the pattern.
  29. Select Save.
  30. Select Submit.
  31. Select Configuration.
  32. You must create a Processing Policy to convert the beSECURE data as searchable data in Logpoint. To create a policy, do the following:
    1. Select Processing Policy.
    2. Create a new policy and name it beSECURE_Processing.
    3. In the Normalizing Policy box, select beSECURE.
    4. In the Enrichment Policy box, select None.
    5. In the Routing Policy box, select default.
  33. Select Submit.
  34. On the Log Collection Policy page, select beSECURE_Collection, and then click on the Sign.
  35. Select the Syslog section, and then change the Processing Policy to beSECURE_Processing.
  36. By default, Logpoint does not allow incoming Syslog connections unless the device has been configured. You will need to allow beSECURE to connect to Logpoint. To allow Syslog connections, do the following:
    1. Select Devices.
    2. Select Add.
    3. In the Name box, enter beSECURE.
    4. Enter the IP address of your beSECURE server.
    5. In the Device Group box, select Linux.
    6. In the Log Collection Policy box, select beSECURE_Collection.
  37. Select Submit.

 

Configuring beSECURE to integrate with Logpoint

To integrate beSECURE with Logpoint, do the following:

  1. Log in to beSECURE.
  2. Select More > Server > Integration.
  3. Select Logpoint.
  4. Enter your Logpoint Hostname and Port in the boxes provided.
  5. In the Send Scan Start box, enter the following: 
    Scan <!-- #Name# --> started
  6. In the Send Scan Completed box, enter the following: 
    Scan <!-- #Name# --> completed
  7. In the Send Scan Results box, enter the following: 
    TestID=<!-- #TestID# --> VulnerabilityName=<!-- #VulnerabilityName# --> RiskNo=<!-- #RiskFactorValue# --> RiskText=<!-- #RiskFactorName# --> AffectedHost=<!-- #AffectedHost# -->  AffectedPort=<!-- #AffectedPort# --> AffectedProtocol=<!-- #AffectedProto# --> CVE=<!-- #CVE# -->   CVSSScore=<!-- #CVSSScore# -->
  8. Select Save. The Syslog entries will appear in Logpoint as soon as a scan completes. You can use norm_id="beSECURE" to look for them in their normalized way.