Upload
hoangdieu
View
244
Download
0
Embed Size (px)
Citation preview
1
Integrate Cisco IronPort (ESA)
Abstract This guide provides instructions to configure Cisco IronPort Email Security Appliance (ESA) to send the Syslog
events to EventTracker.
Scope The configurations detailed in this guide are consistent with EventTracker version 7.x and later, and Cisco
IronPort Email Security Appliance AsyncOS v8.0, v9.0 and v10.0.
Audience Cisco IronPort Email Security Appliance users, who wish to forward events to EventTracker Manager.
The information contained in this document represents the current view of EventTracker. on the
issues discussed as of the date of publication. Because EventTracker must respond to changing
market conditions, it should not be interpreted to be a commitment on the part of EventTracker,
and EventTracker cannot guarantee the accuracy of any information presented after the date of
publication.
This document is for informational purposes only. EventTracker MAKES NO WARRANTIES,
EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the
rights under copyright, this paper may be freely distributed without permission from
EventTracker, if its content is unaltered, nothing is added to the content and credit to
EventTracker is provided.
EventTracker may have patents, patent applications, trademarks, copyrights, or other intellectual
property rights covering subject matter in this document. Except as expressly provided in any
written license agreement from EventTracker, the furnishing of this document does not give you
any license to these patents, trademarks, copyrights, or other intellectual property.
The example companies, organizations, products, people and events depicted herein are fictitious.
No association with any real company, organization, product, person or event is intended or
should be inferred.
© 2017 EventTracker Security LLC. All rights reserved. The names of actual companies and
products mentioned herein may be the trademarks of their respective owners.
2
Integrate Cisco IronPort (ESA)
Table of Contents Abstract ................................................................................................................................................................. 1
Overview ................................................................................................................................................................ 3
Prerequisites .......................................................................................................................................................... 3
Send Cisco IronPort Email Security Appliance Logs to an EventTracker ............................................................... 3
EventTracker Knowledge Pack (KP) ....................................................................................................................... 5
Categories .......................................................................................................................................................... 5
Alerts ................................................................................................................................................................. 5
Flex Reports ....................................................................................................................................................... 6
Import Cisco IronPort ESA Knowledge Pack into EventTracker .......................................................................... 11
Category .......................................................................................................................................................... 12
Alerts ............................................................................................................................................................... 13
Tokens ............................................................................................................................................................. 14
Token Templates ............................................................................................................................................. 15
Flex Reports ..................................................................................................................................................... 16
Verify Cisco IronPort ESA knowledge pack in EventTracker ............................................................................... 17
Categories ........................................................................................................................................................ 17
Alerts ............................................................................................................................................................... 17
Tokens ............................................................................................................................................................. 18
Templates ........................................................................................................................................................ 19
Flex Reports ..................................................................................................................................................... 19
Create Flex Dashboards in EventTracker............................................................................................................. 20
Schedule Reports ............................................................................................................................................. 20
Create Dashlets ............................................................................................................................................... 22
Sample Flex Dashboards...................................................................................................................................... 25
3
Integrate Cisco IronPort (ESA)
Overview
Cisco IronPort Email Security Appliance provides security against antispam, antivirus, encryption, digital rights
management, and archiving technologies to halt. These solutions run on IronPort’s revolutionary MTA
platform, providing the highest levels of email protection, with exclusive preventive and reactive technologies
and industry leading email management tools.
Prerequisites
EventTracker v7.x or later should be installed.
Admin privileges for Cisco IronPort ESA is required
An exception should be added into windows firewall on EventTracker machine for syslog port 514.
Send Cisco IronPort Email Security Appliance Logs to an
EventTracker
1. Login to your Cisco IronPort user interface.
2. Select System Administration\Log Subscriptions.
3. Click Add Log Subscription.
Figure 1
4
Integrate Cisco IronPort (ESA)
4. Configure the following values:
Log Type - Define a log subscription. Choose the log file type for this subscription:
IronPort Text Mail Logs
Delivery Logs
Bounce Logs
Status Logs
Domain Debug Logs
Injection Debug Logs
System Logs
CLI Audit Logs
FTP Server Logs
HTTP Logs
NTP logs
LDAP Debug Logs
Anti-Virus Logs
Anti-Virus Archive
Scanning Logs
IronPort Spam Quarantine Logs
IronPort Spam Quarantine GUI Logs
Reporting Logs
Reporting Query Logs
Updater Logs
Log Name - Type a log name.
File Name - Use the default configuration value.
Maximum File Size - Use the default configuration value.
Log Level - Select Information (Default).
Retrieval Method - Select Syslog Push.
Hostname - Type the IP address or server name of your EventTracker Manager Machine
Protocol - Select UDP.
Facility - Use the default configuration value. This value depends on the configured Log Type.
5. Save the subscription.
5
Integrate Cisco IronPort (ESA)
EventTracker Knowledge Pack (KP) Once logs are received in to EventTracker, Alerts and Reports can be configured into EventTracker.
The following Knowledge Packs are available in EventTracker v7.x to support Cisco ESA monitoring:
Categories
Cisco IronPort ESA: Email bounced - This category provides information related to email bounced due
to delay.
Cisco IronPort ESA: User authentication failed - This category provides information related to user
authentication failure.
Cisco IronPort ESA: User authentication success - This category provides information related to user
authentication success.
Cisco IronPort ESA: FTP activity – This category provides information related to File Transfer protocol
activity.
Cisco IronPort ESA: System activity – This category provides information related to configuration
changes by the user.
Cisco IronPort ESA: HTTP activity – This category provides information related to HTTP activity.
Cisco IronPort ESA: File reputation – This category provides information related to File reputation
server initialization and response to the query received from the server.
Cisco IronPort ESA: CLI audit – This category provides information related commands entered for
particular CLI session.
Alerts
Cisco IronPort ESA: Email bounced - This alert is generated when email bounces due to delay from
Cisco IronPort ESA.
Cisco IronPort ESA: User authentication failed - This alert is generated when any user authentication
fails from Cisco IronPort ESA.
Cisco IronPort ESA: Inbound SMTP authentication failed – This alert is generated when SMTP
authentication attempts made during inbound connections are failed.
Cisco IronPort ESA: Outbound SMTP authentication failed – This alert is generated when SMTP
authentication attempts made during outbound connections are failed.
6
Integrate Cisco IronPort (ESA)
Flex Reports Cisco IronPort ESA: User authentication failed – This report provides the information about username who
attempted to log in to the appliance and got failed.
Figure 2
Logs Considered:
Figure 3
Cisco IronPort ESA: User authentication success-This report provides the information about username who
logged in successfully to the appliance.
Figure 4
Figure 5
Cisco IronPort ESA: Email bounced-This report provides the information about the email id which got
bounced.
Figure 6
7
Integrate Cisco IronPort (ESA)
Figure 7
Cisco IronPort ESA: HTTP activity-This report provides the information about username who accessed the
requested resources through HTTP method.
Figure 8
Figure 9
Cisco IronPort ESA: System activity-This report provides the information about configuration changed by the
admin.
Figure 10
Figure 21
8
Integrate Cisco IronPort (ESA)
Cisco IronPort ESA: CLI audit- This report provides the information about commands entered for the
particular CLI session and displays the CLI output.
Figure 32
Figure 43
Cisco IronPort ESA: FTP activity-This report provides the information about data uploaded, downloaded or
transferred over the FTP.
Figure 54
9
Integrate Cisco IronPort (ESA)
Logs Considered:
Figure 65
Cisco IronPort ESA: File reputation-This report provides the information about initialization of file reputation
query and response received for file reputation query from file reputation server.
Figure 76
Logs Considered:
Figure 87
10
Integrate Cisco IronPort (ESA)
Cisco IronPort ESA: Message scanning status- This report provides the information related to email
attachments being scanned by antivirus, anti-spam and set the behavior to drop, bounce or deliver.
Figure 98
Logs Considered:
NOTE: To gather more information about the events, perform Log Search using the regex
(Info\:\s+MID\s+).*|(Info\:\s+.*MID\s+).*|(Warning\:\s+MID).*
Figure 109
11
Integrate Cisco IronPort (ESA)
Import Cisco IronPort ESA Knowledge Pack into
EventTracker NOTE:
Import knowledge pack items in the following sequence
Categories
Alerts
Templates
Flex Reports
Export Knowledge pack items in the following sequence
Categories
Alerts
Templates
Flex Reports
1. Launch EventTracker Control Panel. 2. Double click Export Import Utility, and then click the Import tab.
Figure 20
3. Click Import tab.
12
Integrate Cisco IronPort (ESA)
Category
1. Click Category option, and then click the browse button.
Figure 21
2. Locate All Cisco IronPort ESA group of Categories.iscat file, and then click the Open button. 3. To import categories, click the Import button.
EventTracker displays success message.
Figure 22
4. Click OK, and then click the Close button.
13
Integrate Cisco IronPort (ESA)
Alerts
1. Click Alerts option, and then click the browse button.
2. Locate the All Cisco IronPort ESA group of alerts.isalt file, and then click the Open button.
Figure 23
3. To import alerts, click the Import button.
EventTracker displays success message.
Figure 24
4. Click OK, and then click the Close button.
14
Integrate Cisco IronPort (ESA)
Tokens
1. To import tokens, click Token value option, and then click the browse button.
Figure 25
2. Locate All Cisco IronPort ESA group of Tokens.istoken file, and then click the Open button. 3. Click the Import button.
EventTracker displays success message.
Figure 26
4. Click OK, and then click the Close button.
15
Integrate Cisco IronPort (ESA)
Token Templates 1. Select Parsing Rules from Admin drop-down. 2. Select Template tab.
3. Click ‘Import’ option and select Browse button.
Figure 27
4. Locate All Cisco IronPort ESA group of token templates.ettd file, and then click the UPLOAD button.
Figure 28
5. Now select the check box and then click on ‘Import’ option.
EventTracker displays success message.
Figure 29
6. Click OK, and then click the Close button.
16
Integrate Cisco IronPort (ESA)
Flex Reports
1. Click Reports option, and then click the browse button.
2. Locate the All Cisco IronPort ESA group of flex reports.issch file, and then click the Open button.
Figure 30
3. Click the Import button to import the scheduled reports. EventTracker displays success message.
Figure 31
4. Click OK, and then click the Close button.
17
Integrate Cisco IronPort (ESA)
Verify Cisco IronPort ESA knowledge pack in
EventTracker
Categories 1. Logon to EventTracker Enterprise. 2. Click the Admin menu, and then click Categories. 3. In the Category Tree, expand Cisco IronPort ESA group folder to view the imported categories.
Figure 32
Alerts 1. In the EventTracker Enterprise, web interface, click the Admin dropdown, and then click Alerts.
2. In the Search field, type ‘Cisco IronPort ESA', and then click Go button.
Alert Management page will display all the imported ‘Cisco IronPort ESA' alert.
Figure 33
18
Integrate Cisco IronPort (ESA)
3. To activate the imported alerts, select the respective checkbox in the Active column. EventTracker
displays message box.
Figure 34
4. Click OK, and then click the Activate Now button. NOTE: You can select alert notification such as Beep, Email, and Message etc. For this, select the respective checkbox in the Alert management page, and then click the Activate Now button.
Tokens 1. Logon to EventTracker Enterprise. 2. Click the Admin menu, and then click Parsing rule.
Imported Cisco IronPort ESA tokens added in Token-Value Groups list at left side of Parsing rule tab of EventTracker Enterprise.
Figure 35
19
Integrate Cisco IronPort (ESA)
Templates 1. Click the Admin menu, and then click Parsing rule.
2. Select Template tab, and then click on ‘Import’ option.
Figure 36
Flex Reports 1. In the EventTracker Enterprise, web interface, click the Reports menu, and then select Configuration.
2. In Reports Configuration pane, select Defined option.
3. In search box enter ‘Cisco IronPort ESA’, and then click the Search button.
EventTracker displays Flex reports of ‘Cisco IronPort ESA’.
Figure 37
20
Integrate Cisco IronPort (ESA)
Create Flex Dashboards in EventTracker NOTE: To configure the flex dashboards, schedule and generate the reports. Flex dashboard feature is
available from EventTracker Enterprise v8.0.
Schedule Reports 1. Open EventTracker in browser and logon.
Figure 38
2. Navigate to Reports>Configuration.
3. Select Cisco IronPort ESA in report groups. Check Defined dialog box.
Figure 39
21
Integrate Cisco IronPort (ESA)
4. Click on ‘schedule’ to plan a report for later execution.
Figure 40
Figure 41
5. Check column names to persist using PERSIST checkboxes beside them. Choose suitable Retention period.
22
Integrate Cisco IronPort (ESA)
6. Proceed to next step and click Schedule button. 7. Wait till the reports get generated.
Create Dashlets 1. Open EventTracker Enterprise in browser and logon.
Figure 42
2. Navigate to Dashboard>Flex. Flex Dashboard pane is shown.
Figure 43
3. Fill suitable title and description and click Save button.
4. Click to configure a new flex dashlet. Widget configuration pane is shown.
23
Integrate Cisco IronPort (ESA)
Figure 44
5. Locate earlier scheduled report in Data Source dropdown. 6. Select Chart Type from dropdown. 7. Select extent of data to be displayed in Duration dropdown. 8. Select computation type in Value Field Setting dropdown. 9. Select evaluation duration in As Of dropdown. 10. Select comparable values in X Axis with suitable label. 11. Select numeric values in Y Axis with suitable label. 12. Select comparable sequence in Legend. 13. Click Test button to evaluate. Evaluated chart is shown.
24
Integrate Cisco IronPort (ESA)
Figure 45
14. If satisfied, click Configure button.
Figure 46
15. Click ‘customize’ to locate and choose created dashlet.
16. Click to add dashlet to earlier created dashboard.
25
Integrate Cisco IronPort (ESA)
Sample Flex Dashboards For below dashboard DATA SOURCE: Cisco IronPort ESA-File reputation
1. Cisco IronPort ESA: File reputation
WIDGET TITLE: Cisco IronPort ESA File reputation
CHART TYPE: Stacked Column
AXIS LABELS [X-AXIS]: File Name
Label Text: Source IP
LEGEND [SERIES]: Disposition
Figure 47
26
Integrate Cisco IronPort (ESA)
2. Cisco IronPort ESA: HTTP activity
WIDGET TITLE: Cisco IronPort ESA HTTP activity
CHART TYPE: Stacked Column
AXIS LABELS [X-AXIS]: HTTP Method
Label Text: HTTP Method
LEGEND [SERIES]: Status Code
Figure 48