Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

BalaBit IT Security for Microsoft ISA or TMG Events

 

You can integrate the BalaBit Syslog-ng Agent application to forward syslog events to JSA.

The BalaBit Syslog-ng Agent reads Microsoft ISA or Microsoft TMG event logs, and forwards syslog events by using the Log Extended Event Format (LEEF).

The events that are forwarded by BalaBit IT Security are parsed and categorized by the Microsoft Internet and Acceleration (ISA) DSM for JSA. The DSM accepts both Microsoft ISA and Microsoft Threat Management Gateway (TMG) events.

Before You Begin

Before you can receive events from BalaBit IT Security Syslog-ng Agents you must install and configure the agent to forward events.

Note

This integration uses BalaBit's Syslog-ng Agent for Windows and BalaBit's Syslog-ng PE to parse and forward events to JSA for the DSM to interpret.

Review the following configuration steps before you attempt to configure the BalaBit Syslog-ng Agent:

To configure the BalaBit Syslog-ng Agent, you must take the following steps:

  1. Install the BalaBit Syslog-ng Agent on your Windows host. For more information, see your BalaBit Syslog-ng Agent vendor documentation.

  2. Configure the BalaBit Syslog-ng Agent.

  3. Install a BalaBit Syslog-ng PE for Linux or Unix in relay mode to parse and forward events to JSA. For more information, see your BalaBit Syslog-ng PE vendor documentation.

  4. Configure syslog for BalaBit Syslog-ng PE.

  5. Optional. Configure the log source in JSA.

Configure the BalaBit Syslog-ng Agent

Before you can forward events to JSA, you must specify the file source for Microsoft ISA or Microsoft TMG events in the Syslog-ng Agent collects.

If your Microsoft ISA or Microsoft TMG appliance is generating event files for the Web Proxy Server and the Firewall Service, both files can be added.

Configuring the BalaBit Syslog-ng Agent File Source

Use the BalaBit Syslog-ng Agent file source to define the base log directory and files that are to be monitored by the Syslog-ng Agent.

  1. From the Start menu, select All Programs >syslog-ng Agent for Windows >Configure syslog-ng Agent for Windows.

    The Syslog-ng Agent window is displayed.

  2. Expand the Syslog-ng Agent Settings pane, and select File Sources.
  3. Select the Enable radio button.
  4. Click Add to add your Microsoft ISA and TMG event files.
  5. From the Base Directory field, click Browse and select the folder for your Microsoft ISA or Microsoft TMG log files.
  6. From the File Name Filter field, click Browse and select a log file that contains your Microsoft ISA or Microsoft TMG events.Note

    The File Name Filter field supports the wild card (*) and question mark (?) characters, which help you to find log files that are replaced, when they reach a specific file size or date.

  7. In the Application Name field, type a name to identify the application.
  8. From the Log Facility list, select Use Global Settings.
  9. Click OK. To add additional file sources, repeat steps 4 to 9.
  10. Click Apply, and then click OK.

    The event configuration is complete. You are now ready to configure a syslog destinations and formatting for your Microsoft TMG and ISA events.

    Web Proxy Service events and Firewall Service events are stored in individual files by Microsoft ISA and TMG.

Configuring a BalaBit Syslog-ng Agent Syslog Destination

The event logs captured by Microsoft ISA or TMG cannot be parsed by the BalaBit Syslog-ng Agent for Windows, so you must forward your logs to a BalaBit Syslog-ng Premium Edition (PE) for Linux or UNIX.

To forward your TMG and ISA event logs, you must specify the IP address for your PE relay and configure a message template for the LEEF format. The BalaBit Syslog-ng PE acts as an intermediate syslog server to parse the events and to forward the information to JSA.

  1. From the Start menu, select All Programs >syslog-ng Agent for Windows >Configure syslog-ng Agent for Windows.

    The Syslog-ng Agent window is displayed.

  2. Expand the Syslog-ng Agent Settings pane, and click Destinations.
  3. Double-click Add new Server.
  4. On the Server tab, click Set Primary Server.
  5. Configure the following parameters:
    • For the Server Name type the IP address of your BalaBit Syslog-ng PE relay.

    • For the Server Port type 514 as the TCP port number for events that are forwarded to your BalaBit Syslog-ng PE relay.

  6. Click the Messages tab.
  7. From the Protocol list, select Legacy BSD Syslog Protocol.
  8. From the File Message Format pane, in the Message Template field, type the following code:

    ${FILE_MESSAGE}${TZOFFSET}

  9. Click Apply, and then click OK.

    The destination configuration is complete. You are now ready to filter comment lines from the event log.

Filtering the Log File for Comment Lines

The event log file for Microsoft ISA or Microsoft TMG might contain comment markers. Comments must be filtered from the event message.

  1. From the Start menu, select All Programs >Syslog-ng Agent for Windows >Configure syslog-ng Agent for Windows.

    The Syslog-ng Agent window is displayed.

  2. Expand the Syslog-ng Agent Settings pane, and select Destinations.
  3. Right-click on your JSA Syslog destination and select Event Filters >Properties.

    The Global event filters Properties window is displayed.

  4. Configure the following values:
    • From the Global file filters pane, select Enable.

    • From the Filter Type pane, select Black List Filtering.

  5. Click OK.
  6. From the Filter List menu, double-click Message Contents.

    The Message Contents Properties window is displayed.

  7. From the Message Contents pane, select Enable.
  8. In the Regular Expression field, type the following regular expression:

    ^#

  9. Click Add.
  10. Click Apply, and then click OK.

    The event messages with comments are no longer forwarded.

    Note

    You might need to restart Syslog-ng Agent for Windows service to begin syslog forwarding. For more information, see your BalaBit Syslog-ng Agent documentation.

Configuring a BalaBit Syslog-ng PE Relay

The BalaBit Syslog-ng Agent for Windows sends Microsoft TMG and ISA event logs to a Balabit Syslog-ng PE installation, which is configured in relay mode.

The relay mode installation is responsible for receiving the event log from the BalaBit Syslog-ng Agent for Windows, parsing the event logs in to the LEEF format, then forwarding the events to JSA by using syslog.

To configure your BalaBit Syslog-ng PE Relay, you must:

  1. Install BalaBit Syslog-ng PE for Linux or Unix in relay mode. For more information, see your BalaBit Syslog-ne PE vendor documentation.

  2. Configure syslog on your Syslog-ng PE relay.

The BalaBit Syslog-ng PE formats the TMG and ISA events in the LEEF format based on the configuration of your syslog.conf file. The syslog.conf file is responsible for parsing the event logs and forwarding the events to JSA.

  1. Using SSH, log in to your BalaBit Syslog-ng PE relay command-line interface (CLI).
  2. Edit the following file:

    /etc/syslog-ng/etc/syslog.conf

  3. From the destinations section, add an IP address and port number for each relay destination.

    For example,

    ###### # destinations destination d_messages { file("/var/log/messages"); }; destination d_remote_tmgfw { tcp("QRadar_IP" port(QRadar_PORT) log_disk_fifo_size(10000000) template(t_tmgfw)); }; destination d_remote_tmgweb { tcp("QRadar_IP" port(QRadar_PORT) log_disk_fifo_size(10000000) template(t_tmgweb)); };

    Where:

    QRadar_IP is the IP address of your JSA console or Event Collector.

    QRadar_Port is the port number that is required for JSA to receive syslog events. By default, JSA receives syslog events on port 514.

  4. Save the syslog configuration changes.
  5. Restart Syslog-ng PE to force the configuration file to be read.

    The BalaBit Syslog-ng PE configuration is complete. Syslog events that are forwarded from the BalaBit Syslog-ng relay are automatically discovered by JSA as Microsoft Windows Security Event Logs on the Log Activity tab. For more information, see the Juniper Secure Analytics Users Guide.

    Note

    When you are using multiple syslog destinations, messages are considered to be delivered when they successfully arrive at the primary syslog destination.

Configuring a Log Source

JSA automatically discovers and creates a log source for syslog events from LEEF formatted messages that are provided by your BalaBit Syslog-ng relay.

The following configuration steps are optional.

  1. Log in to JSA.
  2. Click the Admin tab.
  3. On the navigation menu, click Data Sources.

    The Data Sources pane is displayed.

  4. Click the Log Sources icon.

    The Log Sources window is displayed.

  5. Click Add.

    The Add a log source window is displayed.

  6. In the Log Source Name field, type a name for the log source.
  7. In the Log Source Description field, type a description for the log source.
  8. From the Log Source Type list, select Microsoft ISA.
  9. From the Protocol Configuration list, select Syslog.

    The Syslog Protocol Configuration is displayed.

  10. Configure one of the following parameters from the table:

    Table 1: Syslog Parameters

    Parameter

    Description

    Log Source Identifier

    Type the IP address or host name for the log source as an identifier for Microsoft ISA or Microsoft Threat Management Gateway events from the BalaBit Syslog-ng Agent.

  11. Click Save.
  12. On the Admin tab, click Deploy Changes.

    The BalaBit IT Security configuration for Microsoft ISA and Microsoft TMG events is complete.