Collect Nutanix Prism logs

Overview

This parser processes Nutanix Prism logs, handling both JSON and syslog formats. It extracts fields from various log structures, normalizes them into UDM, and enriches the data with additional context like user information, network details, and security severity. The parser also performs specific actions based on the HTTP method and log level, categorizing events into UDM event types like USER_LOGIN, STATUS_UPDATE, and GENERIC_EVENT.

Before you begin

• Ensure that you have a Google SecOps instance.
• Ensure that you have privileged access to Nutanix Prism Central.
• Ensure that you have a Windows 2012 SP2 or later or Linux host with systemd.
• If running behind a proxy, ensure the firewall ports are open.

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer ID from the Organization Details section.

Install BindPlane Agent

1. For Windows installation, run the following script: msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet.
2. For Linux installation, run the following script: sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh.
3. Additional installation options can be found in this installation guide.

Configure BindPlane Agent to ingest Syslog and send to Google SecOps

1. Access the machine where BindPlane is installed.

2. Edit the config.yaml file as follows:

   receivers:
     tcplog:
       # Replace the below port <54525> and IP (0.0.0.0) with your specific values
       listen_address: "0.0.0.0:54525" 
   
   exporters:
       chronicle/chronicle_w_labels:
           compression: gzip
           # Adjust the creds location below according the placement of the credentials file you downloaded
           creds: '{ json file for creds }'
           # Replace <customer_id> below with your actual ID that you copied
           customer_id: <customer_id>
           endpoint: malachiteingestion-pa.googleapis.com
           # You can apply ingestion labels below as preferred
           ingestion_labels:
           log_type: SYSLOG
           namespace: Namespace
           raw_log_field: body
   service:
       pipelines:
           logs/source0__chronicle_w_labels-0:
               receivers:
                   - tcplog
               exporters:
                   - chronicle/chronicle_w_labels
   

3. Restart BindPlane Agent to apply the changes using the following command: sudo systemctl bindplane restart

Exporting Syslog from Nutanix Prism

1. Sign in to Prism Central using privileged account.
2. Select Prism Central Settings from the menu.
3. Go to Syslog Server.
4. Click + Configure Syslog Server.
5. Specify values for the input parameters in the Syslog Servers dialog:
   • Server Name: Enter a name for the server (for example, Google SecOps BindPlane Server)
   • IP Address: Enter the IP of your BindPlane Agent.
   • Port: Enter the port on which BindPlane Agent is listening.
   • Transport Protocol: Select TCP.
   • Click Configure.
6. Click + Edit on the Data Sources option.
7. Specify values for the input parameters in the Data Sources and Respective Severity Level dialog:
   • Select API Audit, Audit and Flow.
   • Set Severity Level for each at 6 - Informational.
   • Click Save.

UDM Mapping Table

Changes

2024-02-21

• When "inner_message" is not empty and "not_json" is "true", then set "audit_log" to "true" to support dropped JSON logs.
• Aligned "principal.ip" and "principal.asset.ip" mappings.
• Aligned "target.ip" and "target.asset.ip" mappings.
• Aligned "principal.hostname" and "principal.asset.hostname" mappings.
• When "network_set" is "false", "has_principal" is "true", "has_target" is "false" and "audit_log" is "false", then set "metadata.event_type" to "STATUS_UPDATE".
• When "network_set" is "true", "has_principal" is "true", "has_target" is "false" and "audit_log" is "false", then set "metadata.event_type" to "GENERIC_EVENT".

2024-01-12

• Added support for new format of syslog logs.
• Added a null conditional check before mapping "logstash.ingest.host" to "intermediary.hostname".
• Added a null conditional check before mapping "logstash.process.host" to "intermediary.hostname".
• Added a null conditional check before mapping "logstash.collect.host" to "observer.ip".

2023-12-23

• Added support for new type of AUDIT logs.
• Added new Grok patterns to parse SYSLOG+JSON logs.
• Mapped "affectedEntityList" and "alertUid" to "security_result.detection_fields".
• Mapped "clientIp" and "params.requested_ip_address" to "principal.ip".
• Mapped "defaultMsg" to "metadata.description".
• Mapped "operationType" to "metadata.product_event_type".
• Mapped "originatingClusterUuid" and "sessionId" to "additional.fields".
• Mapped "params.mac_address" to "principal.mac".
• Mapped "uuid" to "metadata.product_log_id".
• Mapped "userName" to "principal.user.user_display_name".
• Mapped "params.vm_name" to "target.resource.name".

2023-01-23

• Mapped "logstash.ingest.host" to "intermediary[0].hostname" instead of "observer.hostname".
• Mapped "logstash.collect.host" to "observer.ip".
• Added null check for "logstash.ingest.host".