Este documento explica como coletar registros do Micro Focus NetIQ Access Manager para o Google Security Operations usando o Bindplane. O Micro Focus NetIQ Access Manager é uma solução de gerenciamento de identidade e acesso (IAM, na sigla em inglês) projetada para proteger aplicativos e dados, oferecendo recursos centralizados de autenticação, autorização e logon único (SSO, na sigla em inglês).
Antes de começar
Verifique se você tem uma instância do Google Security Operations.
Use o Windows 2016 ou uma versão mais recente ou um host Linux com systemd.
Se você estiver executando por trás de um proxy, verifique se as portas do firewall estão abertas.
Verifique se você tem acesso privilegiado ao NetIQ Access Manager.
Receber o arquivo de autenticação de ingestão do Google SecOps
Faça login no console do Google SecOps.
Acesse Configurações do SIEM > Agentes de coleta.
Baixe o arquivo de autenticação de ingestão. Salve o arquivo de forma segura no sistema em que o Bindplane será instalado.
Receber o ID do cliente do Google SecOps
Faça login no console do Google SecOps.
Acesse Configurações do SIEM > Perfil.
Copie e salve o ID do cliente na seção Detalhes da organização.
Instalar o agente do Bindplane
Instalação do Windows
Abra o Prompt de Comando ou o PowerShell como administrador.
Configurar o agente do Bindplane para ingerir o Syslog e enviar ao Google SecOps
Acesse o arquivo de configuração:
Localize o arquivo config.yaml. Normalmente, ele fica no diretório /etc/bindplane-agent/ no Linux ou no diretório de instalação no Windows.
Abra o arquivo usando um editor de texto (por exemplo, nano, vi ou Bloco de Notas).
Edite o arquivo config.yaml da seguinte forma:
receivers:tcplog:# Replace the port and IP address as requiredlisten_address:"0.0.0.0:5252"exporters:chronicle/chronicle_w_labels:compression:gzip# Adjust the path to the credentials file you downloaded in Step 1creds:'/path/to/ingestion-authentication-file.json'# Replace with your actual customer ID from Step 2customer_id:<customer_id>
endpoint:malachiteingestion-pa.googleapis.com# Add optional ingestion labels for better organizationingestion_labels:log_type:SYSLOGnamespace:netiq_accessraw_log_field:bodyservice:pipelines:logs/source0__chronicle_w_labels-0:receivers:-tcplogexporters:-chronicle/chronicle_w_labels
Substitua a porta e o endereço IP conforme necessário na sua infraestrutura.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eThis guide outlines how to collect Micro Focus NetIQ Access Manager logs and send them to Google Security Operations using Bindplane.\u003c/p\u003e\n"],["\u003cp\u003ePrerequisites include having a Google Security Operations instance, Windows 2016+ or Linux with \u003ccode\u003esystemd\u003c/code\u003e, open firewall ports, and privileged access to NetIQ Access Manager.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves obtaining a Google SecOps ingestion authentication file and customer ID, installing the Bindplane agent on either Windows or Linux, and configuring the agent to ingest Syslog.\u003c/p\u003e\n"],["\u003cp\u003eNetIQ Access Manager's Identity Server, Access Gateway, and Logging Server must be configured to forward audit events to Bindplane, using either TCP or UDP.\u003c/p\u003e\n"],["\u003cp\u003eThe feature is covered by the Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms.\u003c/p\u003e\n"]]],[],null,["Collect Micro Focus NetIQ Access Manager logs \nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to collect Micro Focus NetIQ Access Manager logs to Google Security Operations using Bindplane. Micro Focus NetIQ Access Manager is an identity and access management (IAM) solution designed to secure applications and data by providing centralized authentication, authorization, and single sign-on (SSO) capabilities.\n\nBefore you begin\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with `systemd`.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n- Ensure that you have privileged access to NetIQ Access Manager.\n\nGet Google SecOps ingestion authentication file\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**. Save the file securely on the system where Bindplane will be installed.\n\nGet Google SecOps customer ID\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall the Bindplane agent\n\nWindows installation\n\n1. Open the **Command Prompt** or **PowerShell** as an administrator.\n2. Run the following command:\n\n msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet\n\nLinux installation\n\n1. Open a terminal with root or sudo privileges.\n2. Run the following command:\n\n sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh\n\nAdditional installation resources\n\n- For additional installation options, consult this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure the Bindplane agent to ingest Syslog and send to Google SecOps\n\n1. Access the configuration file:\n\n 1. Locate the `config.yaml` file. Typically, it's in the `/etc/bindplane-agent/` directory on Linux or in the installation directory on Windows.\n 2. Open the file using a text editor (for example, `nano`, `vi`, or Notepad).\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n tcplog:\n # Replace the port and IP address as required\n listen_address: \"0.0.0.0:5252\"\n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the path to the credentials file you downloaded in Step 1\n creds: '/path/to/ingestion-authentication-file.json'\n # Replace with your actual customer ID from Step 2\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # Add optional ingestion labels for better organization\n ingestion_labels:\n log_type: SYSLOG\n namespace: netiq_access\n raw_log_field: body\n\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - tcplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Replace the port and IP address as required in your infrastructure.\n\n4. Replace `\u003ccustomer_id\u003e` with the actual customer ID.\n\n5. Update `/path/to/ingestion-authentication-file.json` to the path where the authentication file was saved in the\n [Get Google SecOps ingestion authentication file](/chronicle/docs/ingestion/default-parsers/netiq-am#get-auth-file) section.\n\nRestart the Bindplane agent to apply the changes\n\n- To restart the Bindplane agent in Linux, run the following command:\n\n sudo systemctl restart bindplane-agent\n\n- To restart the Bindplane agent in Windows, you can either use the **Services** console or enter the following command:\n\n net stop BindPlaneAgent && net start BindPlaneAgent\n\nConfigure Identity Server audit events in NetIQ Access Manager\n\n1. Sign in to the NetIQ administration console.\n2. Select **Devices \\\u003e Identity server \\\u003e Servers \\\u003e Edit \\\u003e Auditing and logging**.\n3. For **Audit logging** , select **Enabled**.\n4. To audit all events, select **Select All**.\n5. Click **Apply \\\u003e OK**.\n6. Click **Servers \\\u003e Update servers**.\n\nConfigure Access Gateway audit events in NetIQ Access Manager\n\n1. Sign in to the NetIQ administration console.\n2. Go to **Devices \\\u003e Access gateways \\\u003e Edit \\\u003e Auditing**.\n3. Click **Select All**.\n4. Click **OK \\\u003e OK**.\n5. On the **Access gateways** page, click **Update**.\n\nConfigure Logging Server in NetIQ Access Manager\n\n1. Sign in to the NetIQ administration console.\n2. Click **Auditing**.\n3. Specify the following details:\n\n | **Note:** The log file option is not recommended for production use.\n - **Audit messages using syslog**: select this option to send audit events to the audit server.\n - **Stop service on audit server failure**: leave blank.\n - **Server listening address** : enter **Bindplane** IP Address.\n - **Port** : specify the syslog port used to connect to **Bindplane**.\n - **Format** : select **CSV**.\n - **Management console audit events** : select **All**.\n4. If syslog is selected for auditing, do the following:\n\n 1. In `nam.conf`, change the `SYSLOG_DAEMON` value to `rsyslog`. This changes the default syslog daemon to `rsyslog`.\n 2. To edit the `Auditlogging.cfg` file and set both `SERVERIP` and `SERVERPORT` macros as empty, run the following:\n\n LOGDEST=syslog\n FORMAT=JSON\n SERVERIP=\n SERVERPORT=\n\n5. To configure UDP, run the following:\n\n #$ModLoad imtcp # load TCP listener\n $InputTCPServerRun 1290\n $template ForwardFormat,\"\u003c%PRI%\u003e%TIMESTAMP:::date-rfc3164% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\\n\"\n $ModLoad imudp\n local0.* @FORWARDERIP:\u003cvar translate=\"no\"\u003ePORT_NUMBER\u003c/var\u003e;ForwardFormat\n\n | **Note:** If Audit logs are being forwarded to the remote Bindplane server IP and port using UDP. Replace `{\"\u003cvar\u003e\"}}PORT_NUMBER` with the port number of Bindplane.\n6. Restart the `rsyslog` service.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
