Console
    Contact Us Start free

    Collect Kiteworks (formally Accellion) logs

    Supported in:

    This document explains how to ingest Kiteworks (formerly Accellion) logs to Google Security Operations using Bindplane. The parser extracts the audit_message field from the SYSLOG messages, handling both JSON-formatted messages (using grok to extract the textPayload ) and plain text messages. It then applies a common set of transformations defined in auditd.include and adds specific mappings for SYSCALL type events, enriching the UDM fields with extracted data.

    Before you begin

    Make sure you have the following prerequisites:

    • A Google SecOps instance
    • A Windows 2012 SP2 or later or Linux host with systemd
    • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
    • Privileged access to the Kiteworks (formerly Accellion) management console or appliance

    Get Google SecOps ingestion authentication file

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Collection Agents.
    3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

    Get Google SecOps customer ID

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Profile.
    3. Copy and save the Customer IDfrom the Organization Detailssection.

    Install the Bindplane agent

    Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

    Windows installation

    1. Open the Command Promptor PowerShellas an administrator.

    2. Run the following command:

        msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet

    Linux installation

    1. Open a terminal with root or sudo privileges.

    2. Run the following command:

       sudo  
sh  
-c  
 " 
 $( 
curl  
-fsSlL  
https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
 " 
  
install_unix.sh

    Additional installation resources

    Configure the Bindplane agent to ingest Syslog and send to Google SecOps

    1. Access the configuration file:

      1. Locate the config.yaml file. Typically, it's in the /etc/bindplane-agent/ directory on Linux or in the installation directory on Windows.
      2. Open the file using a text editor (for example, nano , vi , or Notepad).

    2. Edit the config.yaml file as follows:

        receivers 
 : 
  
 udplog 
 : 
  
 # Replace the port and IP address as required 
  
 listen_address 
 : 
  
 "0.0.0.0:514" 
 exporters 
 : 
  
 chronicle/chronicle_w_labels 
 : 
  
 compression 
 : 
  
 gzip 
  
 # Adjust the path to the credentials file you downloaded in Step 1 
  
 creds_file_path 
 : 
  
 '/path/to/ingestion-authentication-file.json' 
  
 # Replace with your actual customer ID from Step 2 
  
 customer_id 
 : 
  
< CUSTOMER_ID 
>  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 # Add optional ingestion labels for better organization 
  
 log_type 
 : 
  
 'ACCELLION' 
  
 raw_log_field 
 : 
  
 body 
  
 ingestion_labels 
 : 
 service 
 : 
  
 pipelines 
 : 
  
 logs/source0__chronicle_w_labels-0 
 : 
  
 receivers 
 : 
  
 - 
  
 udplog 
  
 exporters 
 : 
  
 - 
  
 chronicle/chronicle_w_labels
      • Replace the port and IP address as required in your infrastructure.
      • Replace <CUSTOMER_ID> with the actual customer ID.
      • Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

    Restart the Bindplane agent to apply the changes

    • To restart the Bindplane agent in Linux, run the following command:

       sudo  
systemctl  
restart  
bindplane-agent

    • To restart the Bindplane agent in Windows, you can either use the Servicesconsole or enter the following command:

       net stop BindPlaneAgent && net start BindPlaneAgent

    Configure Syslog forwarding on Kiteworks (formerly Accellion)

    1. Sign in to the Kiteworks Management Consoleas an administrator.
    2. Navigate to the Locationspage using one of these paths:
      • Legacy UI: Go to System > Locations.
      • New UI: Go to System Setup > Locations.
    3. Select the target location from the list.
    4. Go to the External Servicessection.
    5. Expand the Syslog Settingspanel.
    6. Click Addto create a new syslog server configuration.
    7. Provide the following configuration details:
      • Syslog Server: Enter the Bindplane agent IP address.
      • Protocol: Select UDPor TCP, depending on your actual Bindplane agent configuration.
      • Port: Enter the Bindplane agent port number (for example, 514 ).
      • Format: Select JSON Format(recommended for structured parsing).
      • Timezone: Select UTC timezone for universal consistency across systems.
    8. Click Saveto apply the configuration.

    UDM Mapping Table

    Log Field UDM Mapping Logic
    acct
    		principal.user.user_display_name The value of acct from the raw log's msg field.
    acct
    		target.user.user_display_name The value of acct from the raw log's msg field.
    addr
    		principal.ip The value of addr from the raw log's msg field.
    a0
    		security_result.about.labels.value The value of a0 from the raw log's msg field, where the corresponding key is "a0".
    a1
    		security_result.about.labels.value The value of a1 from the raw log's msg field, where the corresponding key is "a1".
    a2
    		security_result.about.labels.value The value of a2 from the raw log's msg field, where the corresponding key is "a2".
    a3
    		security_result.about.labels.value The value of a3 from the raw log's msg field, where the corresponding key is "a3".
    arch
    		security_result.about.platform_version The value of arch from the raw log's msg field. Only applicable for type_name SYSCALL.
    auid
    		about.user.userid The value of auid from the raw log's msg field.
    auid
    		security_result.detection_fields.value The value of auid from the raw log's msg field, where the corresponding key is "auid".
    comm
    		principal.application The value of comm from the raw log's msg field.
    cmd
    		principal.process.command_line The value of cmd from the raw log's msg field.
    cwd
    		security_result.detection_fields.value The value of cwd from the raw log's msg field, where the corresponding key is "cwd".
    cwd
    		target.process.file.full_path The value of cwd from the raw log's msg field.
    exe
    		principal.process.file.full_path The value of exe from the raw log's msg field.
    exe
    		target.process.file.full_path The value of exe from the raw log's msg field.
    exit
    		security_result.about.labels.value The value of exit from the raw log's msg field, where the corresponding key is "Exit Code".
    hostname
    		principal.hostname The value of hostname from the raw log's msg field. Hardcoded value "zing-h2" from the raw log's msg field.
    key
    		security_result.about.registry.registry_key The value of key from the raw log's msg field. Only applicable for type_name SYSCALL.
    log_type
    		metadata.log_type The value of log_type from the raw log.
    msg
    		security_result.action_details The value after res= in the msg field of the raw log.
    msg
    		security_result.summary Combination of fields from the msg field of the raw log. For example, "session_open success" or "setcred success". Parsed from the audit section of the msg field in the raw log. Mapped based on the type field in the raw log. For example, "USER_START" maps to "USER_LOGIN", "CRED_DISP" maps to "USER_LOGOUT", "CRED_ACQ" maps to "USER_LOGIN", "USER_END" maps to "USER_LOGOUT", "CRED_REFR" maps to "USER_LOGIN", "USER_CMD" maps to "USER_LOGIN", "CWD" maps to "STATUS_UPDATE", "PROCTITLE" maps to "STATUS_UPDATE", "USER_ACCT" maps to "USER_UNCATEGORIZED", and "SYSCALL" maps to "USER_UNCATEGORIZED". The value of the type field from the raw log's msg field. Extracted from the audit section of the msg field in the raw log.
    node
    		principal.hostname The value of node from the raw log's msg field.
    pid
    		principal.process.pid The value of pid from the raw log's msg field.
    ppid
    		principal.process.parent_process.pid The value of ppid from the raw log's msg field.
    proctitle
    		target.process.file.full_path Decoded hexadecimal value of proctitle from the raw log's msg field. Hardcoded to "LINUX". Set to "ALLOW" if res=success is present in the raw log's msg field.
    ses
    		network.session_id The value of ses from the raw log's msg field.
    syscall
    		security_result.about.labels.value The value of syscall from the raw log's msg field, where the corresponding key is "Syscall".
    success
    		security_result.summary Combined with other fields to form the summary. For SYSCALL events, the logic is: if success=yes, then "yes, The System call succeeded", otherwise "no, The System call failed".
    terminal
    		principal.terminal The value of terminal from the raw log's msg field.
    timestamp
    		timestamp The value of timestamp from the raw log entry.
    tty
    		principal.terminal The value of tty from the raw log's msg field.
    type
    		metadata.product_event_type The value of type from the raw log's msg field.
    uid
    		about.user.userid The value of uid from the raw log's msg field. Only applicable for type_name SYSCALL.
    uid
    		target.user.userid The value of uid from the raw log's msg field. Set to "SETTING" if type is "USER_ACCT".

    Need more help? Get answers from Community members and Google SecOps professionals.

    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: