Send Syslog Notifications to SIEMs

Asset Manager superusers can use the CEF logging feature to send syslog output to an external viewer in a common-event format. By enabling it, all event notifications to which the superuser has subscribed can be displayed in one preferred Security Information and Event Management (SIEM) viewer such as HP ArcSight, Splunk, or QRadar.

CEF Notifications are either system-related or device-related. The system-related notifications are global and pertain to all of Asset Manager. Device notifications pertain to a particular zone.

Subscribe to receive notifications at Settings > Asset Manager Systems > CEF Notifications > System and Device tabs.

System notices report when an Agent, Collector, Scout, or Zone has been created, started or stopped. They also alert on license status (e.g., reminder, warning, and violation).
Device notices report findings about your network architecture such as when a device, edge, or node has been discovered, updated, or removed.

This section provides an example of integrating to the representative event manager HP ArcSight.

Configure CEF Server

Enable the CEF logging feature to make Asset Manager compile all subscribed event notifications to a logging server. Here's an example of how to enable logging to a HP ArcSight console via the Asset Manager graphical user interface (GUI) or the Asset Manager command-line interface (CLI).

Configure CEF Server using the GUI

Go to Settings > Asset Manager Systems.
Click the CEF Notifications tab.
Identify the logging server to which you want to send event notifications.
- Protocol: Type TCP-IPv4, UDP-IPv4, TCP-IPv6, UDP-IPv6
  Note: Use TCP-IPv4 or UDP-IPv4 for HP ArcSight.)
- Host Name or IP Address: Must be an IPv4-type IP address
- Port number: Must be a valid integer
When you are ready to send CEF formatted event notifications, click the CEF Enabled checkbox.
Click Submit.
A message displays, indicating that your configuration settings were saved.
Asset Manager is now configured to display CEF-formatted syslog output in your ArcSight console.

Configure CEF Server using CLI

Log in the Command-Line Interface (CLI).
1. Open a host or server that supports SSH.
2. At the prompt, type ssh admin@<yourservername> and press Enter.
3. Enter your password (i.e., admin) and press Enter.
At the command prompt, type
log cefserver <enable/disable> <protocol> <IP address> <port number> and press Enter.
- Protocol: Type TCP-IPv4, UDP-IPv4, TCP-IPv6, UDP-IPv6 (Note: Use TCP-IPv4 or UDP-IPv4 for HP ArcSight.)
- IP Address: Must be an IPv4 type IP address
- Port number: Must be a valid integer
- Enable: Enables the CEFserver
- Disable: Disables the CEFserver

Asset Manager is now configured to display CEF-formatted syslog output in your HP ArcSight console.

Configuring CEF-Formatted Syslog Output

On the CEF Notifications tab, click the tab for the type of CEF Notifications to which you want to subscribe: either System or Device.
To edit the prioritization of the event and whether you subscribe to it, click Edit and update the form.
- Subscribed: Indicates whether or not you've opted to send notifications of the particular event type.
- Name: Name of the event
- Priority: Indicates level of severity: informational, alert, or warning.
- Event Type: The Event Type is the predefined category of event.
To Add a device notification, click Add and update the form.
To apply additional filters to your device notifications, update this form:

CEF Output

Message Sample
msg=Device stealth:c:3038:1 created.

Asset Manager-specific Fields
The message is followed by Asset Manager specific custom fields mapped to CEF attributes. All custom fields are appended after "msg."

CEF Event Mapping

Following is a CEF notification and how it maps to custom fields in Asset Manager.

	Asset Manager Custom Fields
CEF Key Name	Full Name	Data Type	Asset Manager name	Mapping to a notification from Asset Manager
Device Vendor		Asset Manager	Asset Manager
Device Product			Asset Manager	Asset Manager
Device Version			2.1 (version of Asset Manager)	3.2.4
Signature ID		String or integer	Notification Type	DEVICE_DISCOVERED
Name		String	NotificationName/NotificationType	Device Discovered
Severity		Integer	1, 5, 10	5
cat	deviceEventCategory	String	DISCOVERY("/discovery"), SYSTEM("/system"), CONFIG("/config")	DISCOVERY
deviceMacAddress	deviceMacAddress	MAC Address	mac
dvc	deviceAddress	IPV4 Address	ip
rt	receiptTime	TimeStamp	event.getTimeStamp()	Nov 02 2017 13:19:55
dvchost	deviceHostName	String	systemName	CCM-AMC
dhost	destinationHostName	String	ip	c6a3
c6a3	destination format	IPv6	ip
suser	sourceUserName	String	userName
cn1	deviceCustomNumber1	Long	zoneId	1
cn1Label	deviceCustomNumber1Label	String	zoneName	Facility Zone1

CEF Event Type	Description	Sample Message
AGENT_CONNECTED	A connection was created between discovery-agent and Asset Manager-webapp	Discovery Agent Connected
AGENT_START	Displays one of the following Agent and that it has started: TCP Port Scanner\|Host Discovery\|Snmp Hunter\|Snmp Scanner\|Path Scanner\|Broadcast Discovery\|CIFSScanner\|DNSScanner\|Http Scanner\|Leak Discovery	Host Discovery (or any other agent name) Started Agents: TCP Port Scanner\|Host Discovery\|Snmp Hunter\|Snmp Scanner\|Path Scanner\|Broadcast Discovery\|CIFSScanner\|DNSScanner\|Http Scanner\|Leak Discovery
AGENT_STATUS	Displays the Agent Name (to show that the Agent is currently running): TCP Port Scanner\|Host Discovery\|Snmp Hunter\|Snmp Scanner\|Path Scanner\|Broadcast Discovery\|CIFSScanner\|DNSScanner\|Http Scanner\|Leak Discovery	Host Discovery (or any other agent name)
AGENT_STOP	Displays one of the following Agent and that it has stopped: TCP Port Scanner\|Host Discovery\|Snmp Hunter\|Snmp Scanner\|Path Scanner\|Broadcast Discovery\|CIFSScanner\|DNSScanner\|Http Scanner\|Leak Discovery	Host Discovery (or any other agent name) Stopped
COLLECTOR_CREATED	New Asset Manager Collector created containing device discovery configuration	Collector <> created
COLLECTOR_REMOVED	Indicated existing Asset Manager Collector has been removed	Collector <> removed
COLLECTOR_UPDATED	Updated discovery configuration was applied to a Asset Manager Collector	Collector <> Config Inserted
DEVICE_ACTIVITY	Discovered device’s status has changed from active to inactive (or vice versa)	Device <> became active. Earlier state : inactive OR Device <> became inactive. Earlier state : active
DEVICE_DISCOVERED	New entry for a Device discovered. Multiple entries for each scan technique	Device<>created
DEVICE_PROFILED	Discovered device’s profile information has changed. Profile information includes device type, operating system, operating system version and vendor.	Device<>profileattributeschanged:DeviceType=<>,OS=<>,Vendor=<>,Version=<>\|2017-11-0709:24:13.384338
DEVICE_REMOVED	Discovered device has become inactive and removed	Device<>removed
DEVICE_UPDATED	Discovered Device has been updated with new information. Multiple entries for each scan technique.	Device<>updated.IPassignedto<>\|IPchangedto<>
FORWARDER_ DISCOVERED	Discovered device has been identified as a forwarding device based on TTL	Device<>forwardstraffic
JOB_COMPLETED	Displays status of a background job that was deployed on the Asset Manager box (example: importing pattern file, importing zone attributes)	Job Success ( jobId : 1, jobName : importPatterns-job )
JOB_STARTED	Displays initialization of a background job that was deployed on the Asset Manager box (example: importing pattern file, importing zone attributes)	Job Started (jobId : 1, jobName : importPatterns-job)
LEAK_DISCOVERED	Asset Manager has identified a potential Leak Path to / from a protected network
LICENSE_REMINDER	User notification that the Asset Manager license is about to expire	License expiration imminent – contact support@Asset Manager.com
LICENSE_VIOLATION	User notification that the Asset Manager license has exceeded the IP Count	License expired – new license required – contact support@Asset Manager.com \| \| IP count exceeded – contact support@Asset Manager.com
LICENSE_WARNING	User notification that the Asset Manager license is approaching the IP Count limit	License expired – contact support@Asset Manager.com \| IP count exceeded – contact support@Asset Manager.com
LINK_DISCOVERED	Path has been discovered between two IPs	Linkdiscoveredbetween<>and<>
LOGLEVEL_UPDATED	Log level has been changed to INFO/WARN/DEBUG	Service <> log level set to <>
NOTIFICATION_ ACKNOWLEDGED	Displays the Notification ID that was acknowledged by the user on Asset Manager System’s map.	Notification<notificationnumber>acknowledged
NOTIFICATION_ ACKNOWLEDGED _ALL	All Notifications on Asset Manager System’s map have been acknowledged for a specific priority.	AllNotificationsacknowledgedforpriority <INFO\|WARN\|ALERT>
OPENPORT_ DISCOVERED	Discovered Device has been found with an open port
ROUTER_DISCOVERED	Discovered Device is now profiled as a router
ROUTER_REMOVED	Discovered Device that was profiled as a router has now been removed
SYSTEM_CONNECT	User notification that a connection has been created between CC <-> Portal, CC <-> Scout	Peer connection established (<> <-> <>)
SYSTEM_DISCONNECT	User notification that a disconnection occured between CC <-> Portal, CC <-> Scout	Peer connection closed (<> <-> <>)
UPDATE_ERROR
UPDATE_REMOTE
UPDATE_STEP
UPDATE_WARNING
USER_CREATED	New Asset Manager user was created	User <> created
USER_REMOVED	Asset Manager user was deleted	User <> removed
USER_UPDATED	Changes were made to an existing Asset Manager user	User <> updated
ZONE_CREATED	New Asset Manager Zone created containing device discovery configuration	Created zone. (name <>, description = <>, updatenotes = "time"=>"2017-11-07 13:35:07.257405-05"
ZONE_REMOVED	Indicated existing Asset Manager Zone has been removed	Deleted zone. (name = <>, description = <>, updatenotes = "time"=>"<>", "user"=>"<>")
ZONE_UPDATED	Updated discovery configuration was applied to a Asset Manager Zone	Zone <> CIDRs Updated