|
1 | 1 | --- |
2 | 2 | id: signal-sciences-waf |
3 | | -title: Signal Sciences WAF - Cloud SIEM |
| 3 | +title: Ingest Signal Sciences WAF Data into Cloud SIEM |
4 | 4 | sidebar_label: Signal Sciences WAF |
5 | 5 | description: Lean how to collect Signal Sciences WAF log messages and sending them to Sumo Logic to be ingested by Cloud SIEM. |
6 | 6 | --- |
7 | 7 |
|
8 | 8 | import useBaseUrl from '@docusaurus/useBaseUrl'; |
9 | 9 |
|
10 | | -This section has instructions for collecting Signal Sciences WAF log messages and sending them to Sumo Logic to be ingested by Cloud SIEM. |
11 | | - |
12 | | -## Step 1: Configure collection |
13 | | - |
14 | | -In this step, you configure an HTTP Source to collect Signal Sciences WAF log messages. You can configure the source on an existing Hosted Collector or create a new collector. If you’re going to use an existing collector, jump to [Configure an HTTP Source](#configure-an-http-source) below. Otherwise, create a new collector as described in [Configure a hosted collector](#configure-a-hosted-collector) below, and then create the HTTP Source on the collector. |
15 | | - |
16 | | -### Configure a Hosted Collector |
17 | | - |
18 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. |
19 | | -1. Click **Add Collector**. |
20 | | -1. Click **Hosted Collector.** |
21 | | -1. The **Add Hosted Collector ** popup appears. < br/><img src={useBaseUrl('img/cse/add-hosted-collector.png')} alt="Add hosted collector" style={{border: '1px solid gray'}} width="500"/> |
22 | | -1. **Name**. Provide a Name for the Collector. |
23 | | -1. **Description**. (Optional) |
24 | | -1. **Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. |
25 | | -1. **Fields**. If you are planning that all the sources you add to this collector will forward log messages to Cloud SIEM, click the **+Add Field** link, and add a field whose name is `_siemForward` and value is *true*. This will cause the collector to forward all of the logs collected by all of the sources on the collector to Cloud SIEM. |
26 | | -:::note |
27 | | -It’s also possible to configure individual sources to forward to Cloud SIEM, as described in the following section. |
28 | | -::: |
29 | | - |
30 | | -### Configure an HTTP Source |
31 | | - |
32 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Data Collection** select **Collection**. You can also click the **Go To...** menu at the top of the screen and select **Collection**. |
33 | | -1. Navigate to the Hosted Collector where you want to create the source. |
34 | | -1. On the **Collectors** page, click **Add Source** next to a Hosted Collector. |
35 | | -1. Select **HTTP Logs & Metrics**. |
36 | | -1. The page refreshes. < br/><img src={useBaseUrl('img/cse/http-source.png')} alt="HTTP source" style={{border: '1px solid gray'}} width="600"/> |
37 | | -1. **Name**. Enter a name for the source. |
38 | | -1. **Description**. (Optional) |
39 | | -1. **Source Host.** (Optional) Enter a string to tag the messages collected from the source. The string that you supply will be saved in a metadata field called `_sourceHost.` |
40 | | -1. **Source Category**. Enter a string to tag the output collected from the source. The string that you supply will be saved in a metadata field called `_sourceCategory`. Make a note of the source category. You’ll supply it in [Step 2](#step-2-configure-signal-sciences-waf) below. |
41 | | -1. **SIEM Processing.** Click the checkbox to configure the source to forward log messages to Cloud SIEM. |
42 | | -1. **Advanced Options for Logs**. For information about the optional advance options you can configure, see [HTTP Logs and Metrics Source](/docs/send-data/hosted-collectors/http-source/logs-metrics/). |
43 | | -1. Click **Save**. |
44 | | -1. Make a note of the HTTP Source URL that is displayed. You’ll supply it in [Step 2](#step-2-configure-signal-sciences-waf) below. |
45 | | - |
46 | | -## Step 2: Configure Signal Sciences WAF |
47 | | - |
48 | | -In this step you configure Signal Sciences WAF to send log messages to the Sumo Logic platform. |
49 | | - |
50 | | -1. Go to the **SigSci Site Tools > Integrations** in the **SigSci** dashboard. |
51 | | -1. Click **Add** for **Generic Webhook**. |
52 | | -1. Paste the HTTP Source URL from the previous step into the **Webhook URL** field and click **Add**. |
53 | | - |
54 | | -For more information on Generic Webhooks refer to the [Generic Webhooks](https://docs.fastly.com/signalsciences/integrations/generic-webhooks/) page in Fastly help. |
55 | | - |
56 | | -## Step 3: Cloud SIEM Ingest Configuration |
57 | | - |
58 | | -In this step, you configure a Sumo Logic Ingest Mapping in Cloud SIEM for the source category assigned to your source or collector you configured in [Step 1](#step-1-configurecollection). The mapping tells Cloud SIEM the information it needs to select the right mapper to process messages that have been tagged with that source category. |
59 | | - |
60 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Sumo Logic**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. |
61 | | -1. On the **Ingest Mappings** tab, click **+ Add Ingest Mapping**. |
62 | | -1. On the **Add Ingest Mapping** popup: |
63 | | - * **Source Category**. Enter the category you assigned to the HTTP Source or Hosted Collector in [Step 1](#step-1-configurecollection). |
64 | | - * **Format**. Enter *JSON.* |
65 | | - * **Vendor**. Enter *SignalSciences*. |
66 | | - * **Product**. Enter *WAF*. |
67 | | - * **Event ID**. Enter *.\** |
68 | | -1. Click **Create** to save the mapping. |
69 | | - |
70 | | -## Step 4: Verify ingestion |
71 | | - |
72 | | -In this step, you verify that your logs are successfully making it into Cloud SIEM. |
73 | | - |
74 | | -1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. |
75 | | -1. On the **Log Mappings ** page search for "Signal Sciences" and check the **Records ** columns. < br/><img src={useBaseUrl('img/cse/signal-sciences-record-volume.png')} alt="Signal Sciences record volume" style={{border: '1px solid gray'}} width="800"/> |
76 | | -1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for Signal Sciences WAF security records. |
77 | | - |
| 10 | +To ingest Signal Sciences data into Cloud SIEM: |
| 11 | +1. [Configure an HTTP Logs and Metrics source](/docs/send-data/hosted-collectors/http-source/logs-metrics/#configure-an-httplogs-and-metrics-source) on a collector. When you configure the source, do the following: |
| 12 | + 1. Select the **Forward to SIEM** option in the source configuration UI. This will ensure all logs for this source are forwarded to Cloud SIEM. |
| 13 | + 1. Make note of the **Source Category**. You'll supply it in a later step. |
| 14 | + 1. After saving the source, click the **Show URL** link and make note of the HTTP source URL. You'll supply it in a later step. |
| 15 | +1. Configure Signal Sciences WAF to send log messages to the Sumo Logic platform: |
| 16 | + 1. Go to the **SigSci Site Tools > Integrations** in the **SigSci** dashboard. |
| 17 | + 1. Click **Add** for **Generic Webhook**. |
| 18 | + 1. Paste the HTTP source URL from the previous step into the **Webhook URL** field and click **Add**. |
| 19 | + For more information on Generic Webhooks refer to the [Generic Webhooks](https://docs.fastly.com/signalsciences/integrations/generic-webhooks/) page in Fastly help. |
| 20 | +1. Configure a Sumo Logic Ingest Mapping in Cloud SIEM for the source category assigned to the source. The mapping tells Cloud SIEM the information it needs to select the right mapper to process messages that have been tagged with that source category. |
| 21 | + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Integrations** select **Sumo Logic**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Ingest Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Ingest Mappings**. |
| 22 | + 1. On the **Ingest Mappings** tab, click **+ Add Ingest Mapping**. |
| 23 | + 1. On the **Add Ingest Mapping** popup: |
| 24 | + * **Source Category**. Enter the category you assigned to the HTTP source you created earlier. |
| 25 | + * **Format**. Enter *JSON.* |
| 26 | + * **Vendor**. Enter *SignalSciences*. |
| 27 | + * **Product**. Enter *WAF*. |
| 28 | + * **Event ID**. Enter *.\** |
| 29 | + 1. Click **Create** to save the mapping. |
| 30 | +1. To verify that your logs are successfully making it into Cloud SIEM: |
| 31 | + 1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the top menu select **Configuration**, and then under **Incoming Data** select **Log Mappings**. <br/>[**New UI**](/docs/get-started/sumo-logic-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Integrations** select **Log Mappings**. You can also click the **Go To...** menu at the top of the screen and select **Log Mappings**. |
| 32 | + 1. On the **Log Mappings ** page search for "Signal Sciences" and check the **Records ** columns. < br/><img src={useBaseUrl('img/cse/signal-sciences-record-volume.png')} alt="Signal Sciences record volume" style={{border: '1px solid gray'}} width="800"/> |
| 33 | + 1. For a more granular look at the incoming records, you can also search the Sumo Logic platform for Signal Sciences WAF security records. |
0 commit comments