Collect Blue Coat ProxySG logs

This document explains how to ingest Blue Coat ProxySG logs to Google Security Operations using Bindplane. The parser handles Blue Coat web proxy logs, supporting SYSLOG+JSON and SYSLOG+KV formats. It uses a series of conditional checks and grok patterns to identify the log format, extracts relevant fields, and maps them to the Unified Data Model (UDM), handling various log structures and edge cases.

Before you begin

Make sure you have the following prerequisites:

• Google SecOps instance
• Windows 2016 or later, or a Linux host with systemd
• If running behind a proxy, firewall ports are open
• Privileged access to Blue Coat ProxySG

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer ID from the Organization Details section.

Install the Bindplane agent

Windows installation

1. Open the Command Prompt or PowerShell as an administrator.

2. Run the following command:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

Linux installation

1. Open a terminal with root or sudo privileges.

2. Run the following command:

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

Additional installation resources

For additional installation options, consult the installation guide.

Configure the Bindlane agent to ingest Syslog and send to Google SecOps

1. Access the configuration file:
   • Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
   • Open the file using a text editor (for example, nano, vi, or Notepad).

2. Edit the config.yaml file as follows:

   receivers:
       tcplog:
           # Replace the port and IP address as required
           listen_address: "0.0.0.0:5145"
   
   exporters:
       chronicle/chronicle_w_labels:
           compression: gzip
           # Adjust the path to the credentials file you downloaded in Step 1
           creds: '/path/to/ingestion-authentication-file.json'
           # Replace with your actual customer ID from Step 2
           customer_id: <customer_id>
           endpoint: malachiteingestion-pa.googleapis.com
           # Add optional ingestion labels for better organization
           ingestion_labels:
               log_type: 'BLUECOAT_WEBPROXY'
               raw_log_field: body
   
   service:
       pipelines:
           logs/source0__chronicle_w_labels-0:
               receivers:
                   - tcplog
               exporters:
                   - chronicle/chronicle_w_labels
   

3. Replace the port and IP address as required in your infrastructure.

4. Replace <customer_id> with the actual customer ID.

5. Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

Restart the Bindplane agent to apply the changes

• To restart the Bindplane agent in Linux, run the following command:

  sudo systemctl restart bindplane-agent
  

• To restart the Bindplane agent in Windows, you can either use the Services console or enter the following command:

  net stop BindPlaneAgent && net start BindPlaneAgent
  

Configure Syslog in Blue Coat ProxySG

1. Sign in to the Blue Coat ProxySG management console.
2. Go to Maintenance > Event Logging > Syslog.
3. Click New.
4. Provide the following configuration details:
   • Loghost: Enter the Bindplane agent IP address.
   • Click OK.
5. Select the Enable Syslog checkbox.
6. Select Level.
7. Select the Verbose checkbox.
8. Click Apply.

Configure a Custom Client in Blue Coat ProxySG

1. Go to Configuration > Access Logging > Logs > Upload Client.
2. Select Streaming in the Log list.
3. Select Custom Client from the Client type list.
4. Click Settings.
5. Select to configure the primary or alternate custom server from the Settings list.
6. Provide the following configuration details:
   • Host: Enter the hostname or IP address of the upload destination.
   • Port: Set to 514.
   • Use secure connections (SSL): Set to Off.
   • Click OK.
   • Click Apply to return to the Upload Client tab.
7. For each log format you want to use among main, im, and streaming, complete the following steps:
   • Select the log.
   • Assign the Upload Client to be the Custom client.
   • Select <No Encryption> and <No Signing>.
   • Save the log file as a text file.
   • Click Upload Schedule > Upload Type.
   • Select Continuously for Upload the access log to stream the access logs.
   • Click OK.
8. Click Apply.

UDM mapping table

Derived Fields (from parser logic):

• metadata.event_type: Determined based on a complex set of conditions involving fields like network.application_protocol, network.http.method, principal.*, target.*, and dst_user.
• metadata.vendor_name: Static value: Blue Coat Systems.
• metadata.product_name: Static value: ProxySG.
• metadata.log_type: Static value: BLUECOAT_WEBPROXY.
• principal.asset.platform_software.platform: Set to WINDOWS if x-client-os contains Windows.
• network.application_protocol: Determined using a lookup table based on _uri_scheme or target.port. Defaults to UNKNOWN_APPLICATION_PROTOCOL.
• network.ip_protocol: Determined using a lookup table based on _uri_scheme. Defaults to UNKNOWN_IP_PROTOCOL.
• security_result.action: Determined based on _policy_action (OBSERVED -> ALLOW, DENIED -> BLOCK).
• security_result.about.labels: Contains labels derived from various fields like rs_server, communication_type, and the status from the SSL log format.
• security_result.detection_fields: Contains various key-value pairs derived from fields like x_virus_id, x_rs_certificate_observed_errors, x_rs_connection_negotiated_cipher_strength, and many others.
• vulns.vulnerabilities: Populated from the proxy_reverse_info field if present, containing vulnerability information like cve_id and about.labels.

Need more help? Get answers from Community members and Google SecOps professionals.