IBM Security Trusteer Apex Advanced Malware Protection

The IBM Security Trusteer Apex Advanced Malware Protection DSM collects event data from a Trusteer Apex Advanced Malware Protection system to JSA.

JSA can collect the following items from the Trusteer Apex Advanced Malware Protection system:

• Syslog events

• Log files (from an intermediary server that hosts flat feed files from the system.)

• Syslog events through SSL/TLS authentication

The following table lists the specifications for the IBM Security Trusteer Apex Advanced Malware Protection DSM:

To configure IBM Security Trusteer Apex Advanced Malware Protection event collection, complete the following steps:

1. If automatic updates are not enabled, download and install the most recent version of the following RPMs from the Juniper Downloads onto your JSA console:

   • DSMCommon RPM

   • Log File Protocol RPM

   • TLS Syslog Protocol RPM

   • IBM Security Trusteer Apex Advanced Malware Protection DSM RPM

2. Choose one of the following options:

   • To send syslog events to JSA, see "Configuring IBM Security Trusteer Apex Advanced Malware Protection to send syslog events to JSA".

   • To collect log files from IBM Security Trusteer Apex Advanced Malware Protection through an intermediary server, see "Configuring a Flat File Feed service". For JSA to retrieve log files from IBM Security Trusteer Apex Advanced Malware Protection, you must set up a flat file feed service on an intermediary SFTP-enabled server. The service enables the intermediary server to host the flat files that it receives from IBM Security Trusteer Apex Advanced Malware Protection and allows for connections from external devices so that JSA can retrieve the log files.

3. If JSA does not automatically discover the log source, add an IBM Security Trusteer Apex Advanced Malware Protection log source on the JSA console.

   The following table describes the parameters that require specific values for IBM Security Trusteer Apex Advanced Malware Protection syslog event collection:

   Table 2: IBM Security Trusteer Apex Advanced Malware Protection Log Source Parameters for Syslog

   Parameter	Value
   Log Source type	IBM Security Trusteer Apex Advanced Malware Protection
   Protocol Configuration	Syslog
   Log Source Identifier	The IP address or host name from the syslog header. If the syslog header does not contain an IP address or a host name, use the packet IP address.
   TLS Listen Port	The default port is 6514.
   Authentication Mode	TLS
   Certificate Type	Select the Provide Certificate option from the list.
   Maximum Connections	The Maximum Connections parameter controls how many simultaneous connections the TLS Syslog protocol can accept for each Event Collector. For each Event Collector, there is a limit of 1000 connections across all TLS syslog log source configurations. The default for each device connection is 50. Note: Automatically discovered log sources that share a listener with another log source count only one time towards the limit. For example, the same port on the same event collector.
   TLS Protocols	Select the version of TLS installed on the client from the drop down list.
   Provided Server Certificate Path	Absolute path of server certificate. For example, /opt/qradar/conf/trusted_certificates/apex-almtls. cert
   Provided Private Key Path	Absolute path of PKCS#8 private key. For example, /etc/pki/tls/private/apex-alm-tls.pk8

   Note:

   When you use the TLS syslog, and you want to use an FQDN to access the system, you must generate your own certificate for the listener, and then specify it in the TLS syslog configuration.

   The following table describes the parameters that require specific values for IBM Security Trusteer Apex Advanced Malware Protection TLS syslog event collection:

   Table 3: IBM Security Trusteer Apex Advanced Malware Protection Log Source Parameters for TLS Syslog protocol

   Parameter	Value
   Log Source type	IBM Security Trusteer Apex Advanced Malware Protection
   Protocol Configuration	TLS Syslog
   Log Source Identifier	The IP address or host name from in syslog header. If the syslog header does not contain an IP address or host name, use the packet IP address.
   TLS Listen Port	The default port is 6514.
   Authentication Mode	TLS
   Authentication Mode	Select the Provide Certificate option from the list.
   Maximum Connections	The Maximum Connections parameter controls how many simultaneous connections the TLS Syslog protocol can accept for each Event Collector. For each Event Collector, there is a limit of 1000 connections across all TLS syslog log source configurations. The default for each device connection is 50. Note: Automatically discovered log sources that share a listener with another log source count only one time towards the limit. For example, the same port on the same event collector.
   TLS Protocols	Select the version of TLS installed on the client from the drop down list.
   Provided Server Certificate Path	Absolute path of server certificate For example /opt/qradar/conf/trusted_certificates/apex-almtls. cert.
   Provided Private Key Path	Absolute path of PKCS#8 private key. For example /etc/pki/tls/private/apex-alm-tls.pk8

   Note:

   When you use the TLS syslog, and you want to use an FQDN to access the system, you must generate your own certificate for the listener, and then specify it in the TLS syslog configuration

   The following table describes the parameters that require specific values for IBM Security Trusteer Apex Advanced Malware Protection Log File collection:

   Table 4: IBM Security Trusteer Apex Advanced Malware Protection Log Source Parameters for Log File Protocol

   Parameter	Value
   Log Source Type	IBM Security Trusteer Apex Advanced Malware Protection
   Protocol Configuration	Log File
   Log Source Identifier	The IP address or host name of the server that hosts the flat file feed.
   Service Type	SFTP
   Remote IP or Hostname	The IP address or host name of the server that hosts the flat file feed.
   Remote Port	22
   Remote User	The user name that you created for JSA on the server that hosts the flat file feed.
   SSH Key File	If you use a password, you can leave this field blank.
   Remote Directory	The log file directory where the flat feed files are stored.
   Recursive	Do not select this option.
   FTP File Pattern	"trusteer_feeds_.*?_[0-9]{8}_[0-9]*?\.csv"
   Start Time	The time that you want your log file protocol to start log file collection.
   Recurrence	The polling interval for log file retrieval.
   Run On Save	Must be enabled.
   Processor	None
   Ignore Previously Processed Files	Must be enabled.
   Event Generator	LINEBYLINE
   File Encoding	UTF-8