Broadcom ProxySG

SamurAI [Local] Collector	SamurAI [Cloud] Collector

This guide describes the steps required to configure Broadcom (formely Blue Coat) ProxySG to send both event logs and access logs to a Samurai Local Collector deployed on your network. Event logs are forwarded via syslog on UDP port 514. Access logs use a custom ELFF format delivered via TCP port 514.

To complete this Integration you will need to:

1) From your Broadcom ProxySG:

• Configure event log syslog
• Configure access log syslog

Configure event log syslog

Perform the following steps to configure event log syslog forwarding:

1. Log in to the Broadcom ProxySG

2. From the command line specify the following commands to enable event log syslog:

enable
config t
event-log
syslog add udp [Local Collector IP Address] 514
syslog enable

where:

[Local Collector IP Address] is the IP address of the Samurai Local Collector deployed on your network.

enable
config t
event-log
syslog loghost [Local Collector IP Address]
syslog enable

3. Optionally, set the event logging level to ensure the appropriate verbosity of events are forwarded. From the CLI:

event-log
level informational

Configure access log syslog

Access logs must be forwarded using a mandatory custom ELFF format. The field order and number of fields must match the specification exactly — logs that do not conform to this format cannot be analysed by the SamurAI platform.

Access log delivery uses TCP port 514 via the Management Console Custom Client upload method.

Step 1 - Create the log format

1. Log in to the Broadcom ProxySG Management Console (https://[ProxySG IP]:8082)

2. Navigate to Configuration > Access Logging > Formats

3. Click New and complete the following fields:

   3.1 Enter a Format Name — for example NTT_format

   3.2 Select W3C Extended Log File Format (ELFF) and enter the following string in the ELFF text box:

   date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation c-port r-ip r-port cs-protocol s-computername c-uri cs(X-Forwarded-For) s-session-id x-http-connect-host
   

3.3 Click Test Format to validate — a Format Syntax correct message confirms the format is valid

3.4 Click OK and then Apply

The table below describes each field in the format:

Step 2 — Create the access log

1. Navigate to Configuration > Access Logging > Logs and select the Logs tab

2. Click New and complete the following:

   2.1 Enter a Log Name — for example NTT_access_log

   2.2 Select the log format created in Step 1 (e.g. NTT_format) as the Log Format

   2.3 Click OK and then Apply

Step 3 — Configure the upload client

1. Select the Upload Client tab, choose your log from the drop-down list at the top, and complete the following:

   1.1 Set Client Type to Custom Client

   1.2 Set Save the log file as to text file

   1.3 Click Settings next to Primary Custom Server and enter:

   Field	Value
   Host	IP address of the Samurai Local Collector
   Port	514

   1.4 Click OK and then Apply

Step 4 — Configure the upload schedule

1. Select the Upload Schedule tab

2. Choose your log from the drop-down list

3. Under Upload the access log, select continuously

4. Click Apply

Step 5 — Apply policy via Visual Policy Manager

1. Navigate to Configuration > Policy > Visual Policy Manager and click Launch

2. From the menu, select Policy > Add Web Access Layer to open the Web Access Layer

3. Right-click the Action cell on the target row and select Set

4. In the Set Action Object window, click New and select Modify Access Logging

5. In the Add Access Logging Object window, complete the following:

   5.1 Enter a Name — for example NTT_logging

   5.2 Under Enable logging to, select the log created in Step 2 (e.g. NTT_access_log)

   5.3 Click OK on both the Add Access Logging Object and Set Action Object windows

6. Confirm that the Action column in the Web Access Layer reflects the new logging action

7. Click Install Policy to apply — a Policy installation was successful message confirms the policy has been applied

Step 6 — Verify logging

1. Navigate to Statistics > Access Logging

2. Select your configured log (e.g. NTT_access_log) and review the log tail to confirm events are being recorded and forwarded

For integrations that utilize a Local Collector where we ingest syslog only, you do not need to follow specific steps in the SamurAI MDR portal as we auto detect the vendor and product. The only reason you need to use the SamurAI MDR portal is if you need to determine the Local Collector IP address. Of course you will still need to ensure the integration is functioning! See Integrations for more information on checking status.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the SamurAI MDR Portal and we shall get it updated.