Knowledge Base
Page tree


In This Document 

Was this document useful? 
Your Rating:
Results:
1 Star2 Star3 Star4 Star5 Star
2 rates

Have a suggestion for the Armor Knowledge Base? Send a message to kb@armor.com.


Home > AMP Account User Guides > Introduction to Log Relay > Obtain Log Relay for Remote Log Collection

This topic applies to Armor Complete and Armor Anywhere users. 

To obtain Log Relay and to configure your account for remote log collection, you must have the following AMP permissions added to your account: 

  • Write Virtual Machine
  • Delete Log Management
  • Read Log Endpoints
  • Read Log Relays
  • Write Log Relays
  • Delete Log Relays

Overview

You can use this document to learn about the specific, high-level steps needed to send additional log types to Armor.

At a high level, you must:

  • Obtain Log Relay
  • Create a remote Log Relay
  • Configure a remote Log Relay

Before you begin:

For Armor Complete users, you must already have a virtual machine in your account  

For Armor Anywhere users,  you must already have downloaded and installed the Armor Agent.

For introductory information on Log Relay, see Introduction to Log Relay.


Step 1: Review requirements

Requirement typeProduct compatibilityDescription
  • Supported Devices 
  • Armor Complete
  • Armor Anywhere

You can only convert Linux machines that are in an OK state.

To learn more about the health status of a virtual machine, see Health Overview Dashboard (Armor Complete) or Health Overview Dashboard (Armor Anywhere). 


Additionally, Log Relay supports devices that do not have the Armor Anywhere agent, such as WAFs or next-generation firewalls. 
  • Pricing information
  • Armor Complete
  • Armor Anywhere

While log collection is available to all users, there is a cost associated with sending and storing logs.

For pricing information, please contact your Account Manager. 

  • Permissions 
  • Armor Complete
  • Armor Anywhere

In order to use Log Relay, you must have the following permissions included in your account: 

  • Write Virtual Machine
  • Delete Log Management
  • Read Log Endpoints
  • Read Log Relays
  • Write Log Relays
  • Delete Log Relays
To learn more about permissions, see Roles and Permissions.
  • Log retention plan 
  • Armor Complete
  • Armor Anywhere

Virtual machines that are converted to a log relay device will be automatically enrolled in the Compliance Professional plan.

This plan:

  • Collects and stores your logs for 13 months at an additional cost.
  • Provides certain HIPAA and PCI compliance.

For pricing information, please contact your Account Manager.

  • Firewall rules
  • Armor Anywhere

Armor Anywhere users must add the following generic firewall rules: 

Inbound / OutboundService / PurposePortDestination 
InboundLog Relay (Logstash)
  • 5140/udp
  • 5141/tcp
The IP address for your virtual machine
OutboundArmor's logging service (ELK)
  • 5443/tcp
  • 5400-5600/tcp (Reserved)
    • Armor reserves the right to utilize this port range for future expansion or service changes.

1c.log.armor.com

  • These endpoints are served by the Amazon Elastic Load Balancers. As a result, the actual endpoints will vary dynamically across Amazon's IP ranges.

The above-mentioned ports do not provide security analytics. To receive security analytics for logs from supported remote log devices, you must add additional firewall rules; these additional ports are described in the configuration documents listed in Step 4: Configure a remote log source (remote Log Relay).

For non-supported remote log sources, collected logs will not receive any security analytics. 

To learn more about firewall rules, see Requirements for Armor Anywhere. 


Step 2: Obtain Log Relay

When you convert a virtual machine into a Log Relay device, your virtual machine / device will still contain the default Armor Agent components, such as FIM, Malware, Patching, etc. 

Option 1: For Armor Anywhere users

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Infrastructure. 
  2. Click Virtual Machines. 
  3. Locate and hover over the desired virtual machine. 
  4. Click the vertical ellipses. 
  5. Click Convert to Log Relay. 
  6. Review pricing information, and then click Convert VM to Log Relay. 
    • You will be redirected to the Virtual Machines screen. 
  7. Under Type, the virtual machine will be labeled as Log Relay. (By default, the Armor agent will update the virtual machine within 15 minutes.)

Option 2: For Armor Complete users

  1. Use the PUT Assign Log Collector API call to add Log Relay to your account. 

    In some cases, the terms Log Depot, Host Log Collector, or Log Relay may be used interchangeably.

    Method / TypePUT
    API call / URL

    /vms/core/{coreInstanceId}/profile 

    Parameters

    You must enter your virtual machine's coreInstanceId.

    To locate this ID, in AMP, access the Virtual Machine screen, click the desired virtual machine to expand, and then copy the Agent ID. The Agent ID is a combination of numbers and letters. 

    Full API call / URL
    PUT https://api.armor.com//vms/core/1gfh39d-hdd78-dhd73-434/profile
  2. Contact Armor Support to add a custom file path via a host log collector.

Step 3: Create a remote log source (remote Log Relay)

  1. In the Armor Management Portal (AMP), in the left-side navigation, click Security. 
  2. Click Log & Data Management. 
  3. Click External Sources. 
    •  If you do not see any data, then click Let's Get Started.
  4. Click External Sources. 
  5. Click the plus ( + ) icon. 
    • If you do not have any log sources already created, then click Add a New Log Source. 

Step 4: Configure a remote log source (remote Log Relay)

Based on your specific log type, review the following options to create and configure a remote log source:

Log typeAdditional informationDetailed instructions
AWS CloudTrail

For this log type, you must be able to:

  • Gather your AWS account information
  • Create a new trail and sync your AWS S3 bucket 
Create a remote log source (AWS CloudTrail)
AWS GuardDuty

For this log type, you must be able to:

  • Update your AWS permissions for GuardDuty, Lambda, CloudWatch, and CloudFormation
  • Retrieve your AWS credentials (AWS account number / account ID, AWS Access Key, AWS Secret Key)
  • Configure the AWS GuardDuty CloudFormation StackSet Template
Create a remote log source (AWS GuardDuty)
Cisco ASA

For this log type, you must be able to: 

  • Log into your Cisco ASA device
  • Access the privileged EXEC mode
Create a remote log source (Cisco ASA)
Cisco ISR 

For this log type, you must be able to: 

  • Log into your Cisco ISR device
  • Access the privileged EXEC mode
Create a remote log source (Cisco ISR)


Common Troubleshooting

In general, if you are having issues adding Log Relay to a remote log device, consider that:

You need to update your permissions in AMP.  

  • In AMP, you must have the following permissions added to your account:  
    • Write Virtual Machine
    • Delete Log Management
    • Read Log Endpoints
    • Read Log Relays
    • Write Log Relays

    • Delete Log Relays 

      To add permissions to your account:

      1. In the Armor Management Portal (AMP), in the left-side navigation, click Account. 
      2. Click Roles + Permissions. 
      3. Locate and select your role.
      4. Mark the above-mentioned AMP  permissions. 
      5. Click Save Role in the bottom of the screen. 

Additional troubleshooting information is located in the specific remote log source documentation. 







Armor Defense Inc. Copyright © 2019. All rights reserved. 

© Armor Defense Inc. 2019. All Rights Reserved.