Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Configuring CloudPassage Halo for Communication with JSA

Before you can configure the Event Connector, you must create a read-only CloudPassage API key. To create a read-only key, log in to your CloudPassage Portal and click Add New Key on the Site Administration window.

To collect CloudPassage Halo events, download and configure the CloudPassage Halo Event Connector script to send syslog events to JSA.

The Event Connector script requires Python 2.6 or later to be installed on the host on which the Event Connector script runs. The Event Connector makes calls to the CloudPassage Events API, which is available to all Halo subscribers.

Note:

You can configure the CloudPassage Halo Event Collect to write the events to file for JSA to retrieve by using the Log File Protocol, however, this method is not recommended.

  1. Log in to the CloudPassage Portal.
  2. Go to to Settings > Site Administration.
  3. Click the API Keys tab.
  4. Click Show for the key you want to use.
  5. Copy the key ID and secret key into a text file.

    Ensure that the file contains only one line, with the key ID and the secret key separated by a vertical bar/pipe (|), for example, your_key_id|your_secret_key. If you want to retrieve events from multiple Halo accounts, add an extra line for each account.

  6. Save the file as haloEvents.auth.
  7. Download the Event Connector script and associated files from https://github.com/cloudpassage/halo-event-connector-python.
  8. Copy the following files to a Linux or Windows system that has Python 2.6 (or later) installed:

    • haloEvents.py

    • cpapi.py

    • cputils.py

    • remote_syslog.py (use this script only if you deploy the Event Connector on Windows and you want to send events through syslog)

    • haloEvents.auth

  9. Set the environment variables on the Linux or Windows system:

    • On Linux, include the full path to the Python interpreter in the PATH environment variable.

    • On Windows, set the following variables:

      • Set the PATH variable to include the location of haloEvents.py and the Python interpreter.

      • Set the PYTHONPATH variable to include the location of the Python libraries and the Python interpreter.

  10. To send events through syslog with the Event Connector is deployed on a Windows system, run the haloEvents.py script with the --leefsyslog=<QRadar IP> switch:

    haloEvents.py --leefsyslog=1.2.3.4

    By default, the Event Connector retrieves existing events on initial connection and then retrieves onlynew events thereafter. To start event retrieval from a specific date, rather than retrieving all historical events on startup, use the --starting=<date> switch, where date is in the YYYY-MM-DD format:

    haloEvents.py --leefsyslog=1.2.3.4 --starting=2014-04-02

  11. To send events through syslog and deploy the Event Connector on a Linux system, configure the local logger daemon.

    1. To check which logger the system uses, type the following command:

      ls -d /etc/*syslog*

      Depending on what Linus distribution you have, the following files might be listed:

        • rsyslog.conf

        • syslog-ng.conf

        • syslog.conf

    2. Edit the appropriate .conf file with relevant information for your environment.

      Example configuration for syslog-ng:

    3. To run the haloEvents.py script with the leeffile=<filepath> switch, type the following command:

      haloEvents.py --leeffile=/var/log/leefEvents.txt

      You can include --starting=YYYY-MM-DD switch to specify the date from which you want events to be collected for on initial startup.

Note:

As an alternative to using syslog, you can write events to a file for JSA to retrieve by using the Log File protocol. For Windows or Linux to write the events to a file instead, use the --leeffile=<filename> switch to specify the file to write to.