receivers:
tcplog:
# Replace the below port <54525> and IP <0.0.0.0> with your specific values
listen_address: "0.0.0.0:54525"
exporters:
chronicle/chronicle_w_labels:
compression: gzip
# Adjust the creds location below according the placement of the credentials file you downloaded
creds: '{ json file for creds }'
# Replace <customer_id> below with your actual ID that you copied
customer_id: <customer_id>
endpoint: malachiteingestion-pa.googleapis.com
# You can apply ingestion labels below as preferred
ingestion_labels:
log_type: SYSLOG
namespace: Brocade_ServerIron
raw_log_field: body
service:
pipelines:
logs/source0__chronicle_w_labels-0:
receivers:
- tcplog
exporters:
- chronicle/chronicle_w_labels
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis guide explains how to collect and parse Brocade ServerIron syslog messages for Google SecOps, including how the parser extracts relevant fields and maps them to the Unified Data Model (UDM).\u003c/p\u003e\n"],["\u003cp\u003eThe process requires setting up a Bindplane Agent on a Windows or Linux host, configuring it to receive syslog data, and then directing that data to Google SecOps using a provided credentials file and customer ID.\u003c/p\u003e\n"],["\u003cp\u003eUsers must configure their Brocade ServerIron ADX to enable syslog logging and direct it to the Bindplane Agent's listening IP and port, ensuring proper protocol and severity level settings.\u003c/p\u003e\n"],["\u003cp\u003eThe parser converts various log data, such as user authentication details, network status, and security events, into structured data, using regular expressions and data type conversions, enriching it when necessary for comprehensive security analysis.\u003c/p\u003e\n"],["\u003cp\u003eThe provided UDM mapping table details how each parsed log field from the Brocade ServerIron is translated to specific fields in the UDM, including principal and target information, security result descriptions, and various metadata.\u003c/p\u003e\n"]]],[],null,["# Collect Brocade ServerIron logs\n===============================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis parser extracts fields from Brocade ServerIron syslog messages using regular expression matching and maps them to the Unified Data Model (UDM). It handles various log formats, including network status, user authentication, and security events. The parser performs data type conversions and enrichment where necessary.\n\nBefore you begin\n----------------\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with systemd.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have privileged access to the Brocade ServerIron instance.\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall Bindplane Agent\n-----------------------\n\n1. For **Windows installation** , run the following script: \n `msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet`\n2. For **Linux installation** , run the following script: \n `sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh`\n3. Additional installation options can be found in this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure Bindplane Agent to ingest Syslog and send to Google SecOps\n--------------------------------------------------------------------\n\n1. Access the machine where Bindplane is installed.\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n tcplog:\n # Replace the below port \u003c54525\u003e and IP \u003c0.0.0.0\u003e with your specific values\n listen_address: \"0.0.0.0:54525\" \n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the creds location below according the placement of the credentials file you downloaded\n creds: '{ json file for creds }'\n # Replace \u003ccustomer_id\u003e below with your actual ID that you copied\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # You can apply ingestion labels below as preferred\n ingestion_labels:\n log_type: SYSLOG\n namespace: Brocade_ServerIron\n raw_log_field: body\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - tcplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Restart the Bindplane Agent to apply the changes:\n\n sudo systemctl restart bindplane\n\nConfigure Syslog Export from Brocade ServerIron ADX\n---------------------------------------------------\n\n1. Sign in to the ADX device and enter global configuration mode:\n\n enable\n configure terminal\n\n2. Enable Syslog Logging:\n\n logging on\n\n3. Specify the IP address or hostname and port of the syslog server, including the desired protocol (Bindplane):\n\n logging host \u003csyslog-server-ip\u003e [udp | tcp] port \u003cport-number\u003e\n\n Example for TCP on port 54525: \n\n logging host 10.10.10.10 tcp port 54525\n\n4. Optional: set the **Syslog Facility** (**local0** to **local7**):\n\n logging facility local0\n\n5. Define the minimum severity level of logs to send to the syslog server:\n\n logging trap \u003cseverity-level\u003e\n\n6. Save the configuration:\n\n write memory\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
