Overview

You can use this document to add a remote log collector to a remote device (log source). 

To learn more, see: 

• Create a remote log source (Wincollect)
• Create a remote log source (CloudTrail)

Step 1: Review compatible log source types and ciphers

Compatible log source types

Supported ciphers

• TLS_RSA_WITH_AES_128_CBC_SHA
  • This is the mandatory cipher.
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA256
• TLS_RSA_WITH_AES_256_CBC_SHA256
• TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

Step 2: Configure your log source

Step 3: Create a remote log source in AMP

There are three options: 

• Create a remote log source for a non-AWS environment
• Create a remote log source for an AWS environment
• Create a remote log source to collect Windows logs

Option 1: Create a remote log source for a non-AWS environment 

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.
2. Click Log & Data Management.
3. Click Log Relay Source.
4. Click the plus ( + ) sign. 
   • If you do not have any log sources already created, then click Add a New Log Source. 
5. Complete the missing fields:
   
   1. In Endpoint, select the available Armor Endpoint.  
   2. In Log Source Type, select the type of log source. 
   3. In Hostname, enter the system hostname that matches the system for log collection.
      1. The hostname is case-sensitive and must match the exact same letters casing as the logs that are sent into this log source.
   4. In Protocol, based on your selection in Log Source Type, select the available protocol.
6. Click Save Log Source.

Option 2: Create a remote log source for an AWS environment

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.
2. Click Log & Data Management.
3. Click Log Relay Source.
4. Click the plus ( + ) sign. 
   • If you do not have any log sources already created, then click Add a New Log Source. 
5. Complete the missing fields:
   1. In Endpoint, select the available Armor Endpoint.
   2. In Log Source Type, select Amazon AWS CloudTrail.
   3. In Hostname, enter the system hostname that matches the system for log collection.
      1. The hostname is case-sensitive and must match the exact same letters casing as the logs that are sent into this log source.
   4. In Protocol, based on your selection in Log Source Type, select the available protocol.
   5. In Account Number, enter your AWS account number, including any zero (0) prefix. 
   6. In Region, select the region for your virtual machine.  
6. Click Save Log Source.
7. In the Sources screen, refresh the screen until the log source reaches an Online status. 
8. Access the AWS console.
9. In AWS console, under Management & Governance, click CloudTrail. 
10. In the left-side navigation, click Trails. 
11. Click Create Trail. 
12. In Trail name, enter a descriptive name for your trail. 
13. Under Storage location, for Create a new S3 bucket, mark No. 
14. In the S3 bucket drop-down menu, select logs.armor.com.
15. Click Create. 

Option 3: Create a remote log source to collect Windows logs

1. Download and install the agent.
   • In this step, two files will be added to your local machine, including the WinCollect Stanadlone Patch installer. This GUI installer can be used to directly configured the WinCollect instance, as well as pull logs from other Windows system. (This process is not supported by Armor.)
2. In the Armor Management Portal (AMP), in the left-side navigation, click Security.
3. Click Log & Data Management.
4. Click Log Relay Source.
5. Click the plus ( + ) sign. 
   • If you do not have any log sources already created, then click Add a New Log Source. 
6. Complete the missing fields:
   1. In Endpoint, select the available Armor Endpoint.
   2. In Log Source Type, select Microsoft Windows Security Event Log. 
   3. In Hostname, enter the system hostname that matches the system for log collection.
      1. The hostname is case-sensitive and must match the exact same letters casing as the logs that are sent into this log source.
   4. In Protocol, based on your selection in Log Source Type, select the available protocol.
7. Click Save Log Source.
8. In the Sources screen, refresh the screen until the log source reaches an Online status. 
9. In your local machine, launch the WinCollect Configuration Utility GUI. 
10. In the left-side window, next to Destinations, click the ( + ) icon. 
11. Click Syslog TCP. 
12. In the top, right menu, click Add New Destination. 
13. Enter a descriptive name, such as Armor Defense Inc TLS, and then click Ok. 
    • The properties screen will appear. 
14. Enter the fully qualified domain name (FQDN) for the event collector. 
15. Enter the port that was allocated for your Windows Event Log source. 
16. Configure a throttle limit, such as 500 EPS.
17. Click Deploy Changes to save. 
18. In the left-side window, under Devices, right-click Microsoft Windows Event Log. 
19. Click Add New Device. 
20. Enter a descriptive name for your log source, such as the system name of your Windows host. 
21. In Device Address, enter the local system hostname for the logs to be collected. 
22. In Security, mark the box. 
23. (Optional) For a DNS Active Directory or File Replication server, make the corresponding box. 
24. In Destinations, click Add. 
25. Select the name of destination you previously created, and then click Ok. 
26. In the top, right menu, click Deploy Changes. 

View existing remote log sources

You can use these instructions to view existing remote log sources. 

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.

2. Click Log & Data Management.

3. Click Sources.

View existing endpoints

You can use these instructions to view existing endpoints.

1. In the Armor Management Portal (AMP), in the left-side navigation, click Security.
2. Click Log & Data Management.
3. Click Endpoint.