Console
    Contact Us Start free

    Collect Cisco eStreamer logs

    Supported in:

    This document explains how to ingest Cisco eStreamer logs to Google Security Operations using Bindplane. The parser extracts fields from the SYSLOG messages in key-value format, using grok to parse the initial message and kv to handle the key-value data. It then maps these extracted fields to the Unified Data Model (UDM), handling various data types and enriching the event with metadata like event type based on the presence of principal and target information.

    Before you begin

    Make sure you have the following prerequisites:

    • A Google SecOps instance
    • A Windows Server 2012 SP2 or later, or Linux host with systemd
    • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
    • Privileged access to the Cisco Firepower Management Center (FMC)
    • A Linux system to run the eNcore CLI client

    Get Google SecOps ingestion authentication file

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Collection Agents.
    3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

    Get Google SecOps customer ID

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Profile.
    3. Copy and save the Customer IDfrom the Organization Detailssection.

    Install Bindplane agent

    Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

    Windows installation

    1. Open the Command Promptor PowerShellas an administrator.

    2. Run the following command:

        msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet

    Linux installation

    1. Open a terminal with root or sudo privileges.

    2. Run the following command:

       sudo  
sh  
-c  
 " 
 $( 
curl  
-fsSlL  
https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
 " 
  
install_unix.sh

    Additional installation resources

    For additional installation options, consult the installation guide .

    Configure the Bindplane agent to ingest Syslog and send to Google SecOps

    1. Access the configuration file:
      • Locate the config.yaml file. Typically, it's in the /opt/observiq-otel-collector/ directory on Linux or `C:\Program Files\observIQ OpenTelemetry Collector` directory on Windows.
      • Open the file using a text editor (for example, nano , vi , or Notepad).

    2. Edit the config.yaml file as follows:

        receivers 
 : 
  
 udplog 
 : 
  
 # Replace the port and IP address as required 
  
 listen_address 
 : 
  
 "0.0.0.0:514" 
 exporters 
 : 
  
 chronicle/chronicle_w_labels 
 : 
  
 compression 
 : 
  
 gzip 
  
 # Adjust the path to the credentials file you downloaded in Step 1 
  
 creds_file_path 
 : 
  
 '/path/to/ingestion-authentication-file.json' 
  
 # Replace with your actual customer ID from Step 2 
  
 customer_id 
 : 
  
 YOUR_CUSTOMER_ID 
  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 # Add optional ingestion labels for better organization 
  
 log_type 
 : 
  
 'CISCO_ESTREAMER' 
  
 raw_log_field 
 : 
  
 body 
  
 ingestion_labels 
 : 
 service 
 : 
  
 pipelines 
 : 
  
 logs/source0__chronicle_w_labels-0 
 : 
  
 receivers 
 : 
  
 - 
  
 udplog 
  
 exporters 
 : 
  
 - 
  
 chronicle/chronicle_w_labels
      • Replace the port and IP address as required in your infrastructure.
      • Replace <customer_id> with the actual customer ID.
      • Update /path/to/ingestion-authentication-file.json to the path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

    Restart the Bindplane agent to apply the changes

    • To restart the Bindplane agent in Linux, run the following command:

       sudo  
systemctl  
restart  
bindplane-agent

    • To restart the Bindplane agent in Windows, you can either use the Servicesconsole or enter the following command:

       net stop BindPlaneAgent && net start BindPlaneAgent

    Configure Syslog forwarding on Cisco eStreamer

    Configure eStreamer on Firepower Management Center

    1. Sign in to the Firepower Management Center.
    2. Go to System > Integration > eStreamer.
    3. Click eStreamerto access the eStreamer Event Configuration.
    4. Select the check boxes next to the types of events you want to capture:
      • Intrusion Events: For intrusion detection events
      • Intrusion Event Packet Data: For packet captures associated with intrusion events
      • Connection Events: For network connection data
      • Security Intelligence Events: For threat intelligence data
      • File Events: For file analysis events
      • Malware Events: For malware detection events
    5. Click Save.

    Create eStreamer Client

    1. In the eStreamerpage, click Create Client.
    2. Provide the following configuration details:
      • Hostname: Enter the IP address of the Linux system where eNcore client will run.
      • Password: Enter a password to encrypt the certificate file.
    3. Click Save.
    4. Download the generated PKCS12 certificate file and transfer it to your eNcore client system.

    Install and Configure eNcore CLI Client

    1. On your Linux system, download the eStreamer eNcore CLI client from Cisco.

    2. Extract the eNcore package:

       tar  
-xzf  
eStreamer-eNcore-*.tar.gz cd 
  
eStreamer-eNcore-*

    3. Run the setup script:

       ./encore.sh  
setup

    4. When prompted, choose the output format for key-value pairs (compatible with SIEM systems).

    5. Enter the FMC IP address and the PKCS12 certificate password.

    6. Configure the estreamer.conf file to output syslog messages to your Bindplane agent:

      • Open the estreamer.conf file in a text editor.

      • Locate the outputters section and configure it to send syslog to your Bindplane agent:

          { 
  
 "handler" 
 : 
  
 { 
  
 "outputters" 
 : 
  
 [ 
  
 { 
  
 "name" 
 : 
  
 "syslog" 
 , 
  
 "adapter" 
 : 
  
 "kvpair" 
 , 
  
 "enabled" 
 : 
  
 true 
 , 
  
 "stream" 
 : 
  
 { 
  
 "uri" 
 : 
  
 "udp://BINDPLANE_AGENT_IP:514" 
  
 } 
  
 } 
  
 ] 
  
 } 
 }

    7. Replace BINDPLANE_AGENT_IP with the IP address of your Bindplane agent.

    Start eNcore Client

    1. Test the connection in foreground mode:

       ./encore.sh  
foreground

    2. Once verified, start eNcore as a background service:

       ./encore.sh  
start

    UDM Mapping Table

    Log Field UDM Mapping Logic
    act
    		security_result.action_details The value of act from the raw log is assigned to this field.
    act
    		security_result.action If the value of act is "Allow" (case-insensitive), then the value "ALLOW" is assigned to this field.
    app
    		network.http.user_agent The value of app (renamed as requestClientApplication in the parser) from the raw log is assigned to this field.
    blockLength
    		security_result.detection_fields[].key The string "blocklength" is assigned to this field.
    blockLength
    		security_result.detection_fields[].value The value of blockLength from the raw log, converted to a string, is assigned to this field.
    blockType
    		security_result.detection_fields[].key The string "blockType" is assigned to this field.
    blockType
    		security_result.detection_fields[].value The value of blockType from the raw log, converted to a string, is assigned to this field.
    bytesIn
    		network.received_bytes The value of bytesIn from the raw log is assigned to this field and converted to an unsigned integer.
    bytesOut
    		network.sent_bytes The value of bytesOut from the raw log is assigned to this field and converted to an unsigned integer.
    cat
    		security_result.category_details The value of cat from the raw log is assigned to this field.
    cs1
    		security_result.detection_fields[].value The value of cs1 from the raw log is assigned to this field.
    cs1Label
    		security_result.detection_fields[].key The value of cs1Label from the raw log is assigned to this field.
    cs2
    		security_result.detection_fields[].value The value of cs2 from the raw log is assigned to this field.
    cs2Label
    		security_result.detection_fields[].key The value of cs2Label from the raw log is assigned to this field.
    cs3
    		security_result.detection_fields[].value The value of cs3 from the raw log is assigned to this field.
    cs3Label
    		security_result.detection_fields[].key The value of cs3Label from the raw log is assigned to this field.
    cs4
    		security_result.detection_fields[].value The value of cs4 from the raw log is assigned to this field.
    cs4Label
    		security_result.detection_fields[].key The value of cs4Label from the raw log is assigned to this field.
    cs5
    		security_result.detection_fields[].value The value of cs5 from the raw log is assigned to this field.
    cs5Label
    		security_result.detection_fields[].key The value of cs5Label from the raw log is assigned to this field.
    cs6
    		security_result.detection_fields[].value The value of cs6 from the raw log is assigned to this field.
    cs6
    		security_result.rule_id The value of cs6 from the raw log is assigned to this field.
    cs6Label
    		security_result.detection_fields[].key The value of cs6Label from the raw log is assigned to this field.
    data
    		security_result.detection_fields[].value The value of data from the suser JSON object in the raw log is assigned to this field if the suser field is a JSON.
    deviceInboundInterface
    		additional.fields[].key The string "deviceInboundInterface" is assigned to this field.
    deviceInboundInterface
    		additional.fields[].value.string_value The value of deviceInboundInterface from the raw log is assigned to this field.
    deviceOutboundInterface
    		additional.fields[].key The string "deviceOutboundInterface" is assigned to this field.
    deviceOutboundInterface
    		additional.fields[].value.string_value The value of deviceOutboundInterface from the raw log is assigned to this field.
    dpt
    		target.port The value of dpt from the raw log is assigned to this field and converted to an integer.
    dst
    		target.asset.ip The value of dst from the raw log is assigned to this field.
    dst
    		target.ip The value of dst from the raw log is assigned to this field.
    dvcpid
    		security_result.about.process.pid The value of dvcpid from the raw log is assigned to this field.
    dvchost
    		target.asset.hostname The value of dvchost from the raw log is assigned to this field.
    dvchost
    		target.hostname The value of dvchost from the raw log is assigned to this field.
    hostname
    		principal.asset.hostname The value of hostname from the raw log is assigned to this field.
    hostname
    		principal.hostname The value of hostname from the raw log is assigned to this field. Determined by parser logic based on the presence of principal and target information. If both are present, the value is "NETWORK_CONNECTION". If only principal is present, the value is "STATUS_UPDATE". If only target is present, the value is "USER_UNCATEGORIZED". Otherwise, the value is "GENERIC_EVENT".
    product_event_type
    		metadata.product_event_type The value of product_event_type from the raw log is assigned to this field.
    product_name
    		metadata.product_name The value of product_name from the raw log is assigned to this field.
    proto
    		network.ip_protocol The value of proto from the raw log is converted to an integer, then mapped to the corresponding IP protocol name (e.g., 6 becomes TCP, 17 becomes UDP) using a lookup included from "parse_ip_protocol.include".
    severity
    		security_result.severity_details The value of severity from the raw log is assigned to this field.
    spt
    		principal.port The value of spt from the raw log is assigned to this field and converted to an integer.
    src
    		principal.asset.ip The value of src from the raw log is assigned to this field.
    src
    		principal.ip The value of src from the raw log is assigned to this field.
    suser
    		security_result.detection_fields[].value The value of suser from the raw log is assigned to this field if it's not a JSON object. If it's a JSON, the data field from the suser object is used.
    suser
    		security_result.detection_fields[].key The string "suser" is assigned to this field.
    ts
    		metadata.event_timestamp The value of ts from the raw log is parsed as a timestamp and assigned to this field. Several timestamp formats are attempted until a successful parse is achieved.
    vendor_name
    		metadata.vendor_name The value of vendor_name from the raw log is assigned to this field.
    version
    		metadata.product_version The value of version from the raw log is assigned to this field.

    Need more help? Get answers from Community members and Google SecOps professionals.

    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: