BLUECOAT REPORTER LOGGING COMMAND UPDATE
BLUECOAT REPORTER LOGGING COMMAND PASSWORD

For p2p the file name is SG_FortiSIEM_bluecoat_p2p.log.For ssl the file name is SG_FortiSIEM_bluecoat_ssl.log.For im the file name is SG_FortiSIEM_bluecoat_im.log.Follow this same process to configure the settings forР’В im, ssl and p2p.Р”Р‡or each of these, you will refer to a different Filename.Clear the selections Use Secure Connections (SSL) and Use Local Time.

BLUECOAT REPORTER LOGGING COMMAND PASSWORD

Use the password you created for ftpuser in FortiSIEM IP address of your FortiSIEM virtual appliance

Under Upload Client, configure these settings.

In the left-hand navigation, select Logs.

Go to Management Console > Configuration > Access Logging > General.

Log=BluecoatP2pLog:/opt/phoenix/cache/bluecoat/172.16.0.141/SG_FortiSIEM_bluecoat_p2p.log Log=BluecoatImLog:/opt/phoenix/cache/bluecoat/172.16.0.141/SG_FortiSIEM_bluecoat_ssl.log

Log=BluecoatWebLog:/opt/phoenix/cache/bluecoat/172.16.0.141/SG_FortiSIEM_bluecoat_main.log

BLUECOAT REPORTER LOGGING COMMAND UPDATE

Update the Epilog configuration in /etc/snare/epilog/nf as shown in this code block, and then restart the epilog daemon with the /etc/init.d/epilogd restart command.

The Epilog client converts each line of the log files in the /opt/phoenix/cache/bluecoat/ directory in real time into a syslog, and sends it to the FortiSIEM parser for processing.

Run vi /etc/passwd to change the home directory for ftpuser to /opt/phoenix/cache/bluecoat.Р”В¬hange only the home directory, do not change any other value.

If the this user already exists, you do not need to create a new one.Р’В The script will ask for the IP address of Blue Coat and the password for the user ftpuser, and will then create the directory /opt/phoenix/cache/bluecoat/. The files sent from Blue Coat will be temporarily stored in this account.Р’В The script will create an user called ftpuser. phCreateBluecoatDestDir command to create an FTP user account.

You must configure SFTP in FortiSIEM first, and then on your Blue Coat web proxy server. The access logs are sent via FTP, where Bluecoat is the client and FortiSIEM is the server. Access logs includes the traffic that Blue Coat proxies between the client and the server. SFTP is used to send access logs to FortiSIEM.

Under Syslog, enter the IP address ofР’В your FortiSIEM virtual appliance for Loghost.

Under Level, select Severe Errors, Configuration Events, Policy Messages, and Informational.

Syslog is used by Blue Coat to send audit logs to FortiSIEM.

Under Community Strings, click Change Read Community, and then enter a community string that FortiSIEM can use to access your device.

Under SNMP General, select Enable SNMP.

The following procedures enable FortiSIEM to discover Bluecoat web proxy. There are no predefined reports for this device. There are no predefined rules for this device. In ADMIN > Device Support > Event, search for 'blue coat' in the Device Type and DescriptionР’В column to see the event types associated with this device. Proxy traffic: attributes include Source IP, Destination IP, Destination Name, Destination Port, URL, Web category, Proxy action, HTTP User Agent, HTTP Referrer, HTTP Version, HTTP Method, HTTP Status Code, Sent Bytes, Received Bytes, Connection Duration Proxy performance: Proxy cache object count, Proxy-to-server metrics: HTTP errors, HTTP requests, HTTP traffic (KBps) Server-to-proxy metrics: HTTP traffic (KBps), Client-to-proxy metrics: HTTP requests, HTTP Cache hit, HTTP errors, HTTP traffic (KBps) Proxy-to-client metrics: HTTP traffic (KBytes)

Bluecoat reporter logging command