SIEM Integration
The SIEM Integration feature allows the Management Console to forward INSIGHT Dashboard and Audit Logs to an external SIEM provider. This allows security and activity data generated by GuardWare to be collected and viewed in the SIEM platform.
SIEM integration is useful when security teams use a central SIEM platform for monitoring and analysing security events instead of relying solely on the logs and dashboards available in GuardWare.
How SIEM Integration Works
The integration uses an HTTP connection to send log data from the Management Console to the SIEM provider.
The configuration consists of:
Connection Settings that define how GuardWare communicates with the SIEM provider.
Custom HTTP Credentials that define where the logs are sent and how the endpoint is authenticated.
Apply On settings that determine which GuardWare events are forwarded.
A separate Custom HTTP Credentials configuration can be added for each log type. This is currently required because Log Type allows only one type to be selected per configuration. For example, you can create one configuration for Dashboard Log and another for Audit Log, allowing both types to be sent to the SIEM.
Configure the Connection
Under Connection Settings, configure the connection between the Management Console and the SIEM provider.
Select the protocol from Protocol Type.
Select your SIEM from the SIEM Provider dropdown.
Enter the Connection Timeout in seconds.
Enter the Retry Count to set how many times GuardWare tries to establish connection before giving up.
Set Log Status to Enable.
Select JSON as the Payload Format.
These settings define how GuardWare connects to the SIEM provider and how the log data is transmitted.
Configure a Log Destination
Under Custom HTTP Credentials, configure the SIEM endpoint for the logs you want to forward.
Collector Name: Enter the name of the collector associated with the SIEM destination.
Endpoint URL: Enter the URL that receives the log data.
Log Type: Select the type of GuardWare log to send using this configuration:
Dashboard Log
Audit Log
Because only one Log Type can be selected in each configuration, create a separate Custom HTTP Credentials configuration if you want to forward both Dashboard Logs and Audit Logs.
Custom HTTP Credentials 1
Dashboard Log
Custom HTTP Credentials 2
Audit Log
Click + Add Header to create an additional configuration.
Configure Authentication
Select the appropriate option under Authentication based on how the SIEM endpoint is configured.
Use None for a Presigned URL
If the SIEM provider provides a presigned URL, select None for Authentication and enter the presigned URL in Endpoint URL.
A presigned URL contains the authentication information within the URL itself, so a separate authentication token is not required.
Use Token Authentication
If the SIEM endpoint requires authentication using a token, select Token.
Enter the required authentication information under Header Name and Header Value.
For Sumo Logic, the HTTP source supports token authentication through an HTTP request header. Sumo Logic identifies the header as x-sumo-token and provides the token when an HTTP source is configured for header-based authentication.
Authentication
Token
Header Name
x-sumo-token
Header Value
<token provided by Sumo Logic>
If the SIEM endpoint requires additional HTTP headers, enter the Header Name and Header Value for each header.
Click + Add Header to add another header.
For example, Sumo Logic's HTTP source supports headers for token authentication and other source-related metadata.
Select the Events To Forward
Under Apply On, select the GuardWare events that should be sent to the SIEM provider. Available event types are:
Document
Tracks access to monitored documents, including when documents are opened or viewed on local devices.
Document Modification
Tracks modifications made to monitored documents, providing visibility into document changes.
Keystroke
Tracks monitored keywords or phrases entered by users and can include a screenshot of the activity for investigation.
Tracks email activity involving sensitive information, including policy violations in email content.
Email Attachment
Tracks sensitive or protected files shared through email attachments.
Chat
Tracks monitored activity involving sensitive information shared through chat applications.
Chat Attachment
Tracks files or sensitive content shared as attachments through chat applications.
Web Post
Tracks sensitive information or files posted or uploaded to websites.
Web Post Attachment
Tracks files shared as attachments through web posts or uploads.
File Scan
Forwards file-scan events generated by GuardWare for monitoring in the SIEM.
Tracks printing activity involving monitored files and sensitive information.
File Upload
Tracks files uploaded or transferred to websites and online services.
USB
Tracks files copied or transferred to removable storage devices such as USB drives.
The Apply On selection controls which events are forwarded through the SIEM integration. Select the events relevant to your monitoring requirements.
Configure the Other Log Type
If you want both Dashboard Logs and Audit Logs in the SIEM, add another Custom HTTP Credentials configuration and select the other log type.
For example:
Configure one destination with Log Type = Dashboard Log.
Click + Add Header to add another configuration.
Configure the second destination with Log Type = Audit Log.
Configure the endpoint and authentication details for each configuration as required.
This allows both log types to be forwarded even though Log Type supports only one selection per configuration.
Last updated