Console
    Start free

    Collect Cyolo OT logs

    Supported in:

    This document explains how to ingest Cyolo Secure Remote Access for OT logs to Google Security Operations using the Bindplane agent.

    Cyolo provides secure remote access for operational technology (OT) environments. The platform generates syslog messages for access events, authentication, and session activities. The parser extracts fields and maps them to the Unified Data Model (UDM).

    Before you begin

    Make sure you have the following prerequisites:

    • A Google SecOps instance
    • Windows Server 2016 or later, or Linux host with systemd
    • Network connectivity between the Bindplane agent and the Cyolo platform
    • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
    • Privileged access to the Cyolo Admin console

    Get Google SecOps ingestion authentication file

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Collection Agents.
    3. Download the Ingestion Authentication File.

    4. Save the file securely on the system where the Bindplane agent will be installed.

    Get Google SecOps customer ID

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Profile.

    3. Copy and save the Customer IDfrom the Organization Detailssection.

    Install the Bindplane agent

    Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

    Windows installation

    1. Open Command Promptor PowerShellas an administrator.

    2. Run the following command:

        msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sc query observiq-otel-collector

      The service should show as RUNNING.

    Linux installation

    1. Open a terminal with root or sudo privileges.

    2. Run the following command:

       sudo  
sh  
-c  
 " 
 $( 
curl  
-fsSlL  
https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
 " 
  
install_unix.sh

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sudo  
systemctl  
status  
observiq-otel-collector

      The service should show as active (running).

    Additional installation resources

    For additional installation options and troubleshooting, see the Bindplane agent installation guide .

    Configure the Bindplane agent to ingest syslog and send to Google SecOps

    Locate the configuration file

    • Linux:

       sudo  
nano  
/etc/bindplane-agent/config.yaml

    • Windows:

       notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

    Edit the configuration file

    • Replace the entire contents of config.yaml with the following configuration:

        receivers 
 : 
  
 udplog 
 : 
  
 listen_address 
 : 
  
 "0.0.0.0:514" 
 exporters 
 : 
  
 chronicle/cyolo_ot 
 : 
  
 compression 
 : 
  
 gzip 
  
 creds_file_path 
 : 
  
 '/etc/bindplane-agent/ingestion-auth.json' 
  
 customer_id 
 : 
  
 '<customer_id>' 
  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 log_type 
 : 
  
 CYOLO_OT 
  
 raw_log_field 
 : 
  
 body 
 service 
 : 
  
 pipelines 
 : 
  
 logs/cyolo_ot_to_chronicle 
 : 
  
 receivers 
 : 
  
 - 
  
 udplog 
  
 exporters 
 : 
  
 - 
  
 chronicle/cyolo_ot

    Configuration parameters

    Replace the following placeholders:

    • Receiver configuration:

      • listen_address : IP address and port to listen on:
        • 0.0.0.0 to listen on all interfaces (recommended)
        • Port 514 is the standard syslog port (requires root on Linux; use 1514 for non-root)

    • Exporter configuration:

      • creds_file_path : Full path to ingestion authentication file:
        • Linux: /etc/bindplane-agent/ingestion-auth.json
        • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
      • customer_id : Customer ID copied from the Google SecOps console
      • endpoint : Regional endpoint URL:
        • US: malachiteingestion-pa.googleapis.com
        • Europe: europe-malachiteingestion-pa.googleapis.com
        • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
        • See Regional Endpoints for complete list

    Save the configuration file

    • After editing, save the file:
      • Linux: Press Ctrl+O , then Enter , then Ctrl+X
      • Windows: Click File > Save

    Restart the Bindplane agent to apply the changes

    • To restart the Bindplane agent in Linux, run the following command:

       sudo  
systemctl  
restart  
observiq-otel-collector

      1. Verify the service is running:

         sudo  
systemctl  
status  
observiq-otel-collector

      2. Check logs for errors:

         sudo  
journalctl  
-u  
observiq-otel-collector  
-f

    • To restart the Bindplane agent in Windows, choose one of the following options:

      • Command Prompt or PowerShell as administrator:

         net stop observiq-otel-collector && net start observiq-otel-collector

      • Services console:

        1. Press Win+R , type services.msc , and press Enter.
        2. Locate observIQ OpenTelemetry Collector.
        3. Right-click and select Restart.

        4. Verify the service is running:

           sc query observiq-otel-collector

        5. Check logs for errors:

            type 
  
 "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

    Configure syslog on Cyolo

    1. Sign in to the CyoloAdmin console.
    2. Go to Monitoring > Settings.
    3. Toggle onthe Export Logs to System Logging Protocol (Syslog).
    4. Go to Integrations > Syslog Server.
    5. Provide the following configuration details:
      • Server name: Enter a meaningful name for this server (for example, Google SecOps Bindplane ).
      • Sites: Select a single siteor multiple sitesfrom the drop-down.
      • IP Address: Enter the Bindplane agent IP address.
      • Port: Enter the Bindplane agent port number for UDP connection.
    6. Click Save.

    UDM mapping table

    Log Field UDM Mapping Logic
    _field
    		additional.fields Merged
    authority_id_label
    		additional.fields Merged
    authority_kind_label
    		additional.fields Merged
    authority_name_label
    		additional.fields Merged
    data_field
    		additional.fields Merged
    duration_label
    		additional.fields Merged
    kind_label
    		additional.fields Merged
    log_level_label
    		additional.fields Merged
    object_id_label
    		additional.fields Merged
    object_kind_label
    		additional.fields Merged
    object_name_label
    		additional.fields Merged
    rules_label
    		additional.fields Merged
    site_id_label
    		additional.fields Merged
    subject_id_label
    		additional.fields Merged
    subject_kind_label
    		additional.fields Merged
    message
    		extensions.auth.type Mapped: user disconnected → MACHINE
    syslog_object_name
    		extensions.auth.type Mapped: login → MACHINE
    inter_host
    		intermediary.asset.hostname Directly mapped
    inter_host
    		intermediary.hostname Directly mapped
    message
    		metadata.description Directly mapped
    msg
    		metadata.description Directly mapped
    syslog_message
    		metadata.description Directly mapped
    syslog_timestamp
    		metadata.event_timestamp Parsed as ISO8601
    time
    		metadata.event_timestamp Parsed as MMM d HH:mm:ss
    timestamp
    		metadata.event_timestamp Parsed as ISO8601
    event_type
    		metadata.event_type Directly mapped
    kind
    		metadata.product_event_type Directly mapped
    prod_type
    		metadata.product_event_type Directly mapped
    id
    		metadata.product_log_id Directly mapped
    syslog_event_id
    		metadata.product_log_id Directly mapped
    product_version
    		metadata.product_version Directly mapped
    message
    		network.application_protocol Mapped: rdp → RDP
    client
    		network.http.parsed_user_agent Directly mapped
    cyolouagent
    		network.http.parsed_user_agent Directly mapped
    client
    		network.http.user_agent Directly mapped
    cyolouagent
    		network.http.user_agent Directly mapped
    syslog_client
    		network.http.user_agent Directly mapped
    cyolosessionid
    		network.session_id Directly mapped
    session_id
    		network.session_id Directly mapped
    hostname
    		observer.hostname Directly mapped
    container_id_label
    		observer.resource.attribute.labels Merged
    internal_event_id_label
    		observer.resource.attribute.labels Merged
    log_source_label
    		observer.resource.attribute.labels Merged
    site_id_label
    		observer.resource.attribute.labels Merged
    site_name_label
    		observer.resource.attribute.labels Merged
    transaction_id_label
    		observer.resource.attribute.labels Merged
    node_id
    		observer.resource.product_object_id Directly mapped
    syslog_hostname
    		principal.asset.hostname Directly mapped
    remote_address
    		principal.asset.ip Merged
    syslog_remote_address
    		principal.asset.ip Merged
    syslog_hostname
    		principal.hostname Directly mapped
    remote_address
    		principal.ip Merged
    syslog_remote_address
    		principal.ip Merged
    country_code
    		principal.location.country_or_region Directly mapped
    cyolocountrycode
    		principal.location.country_or_region Directly mapped
    syslog_country_code
    		principal.location.country_or_region Directly mapped
    node_id_label
    		principal.resource.attribute.labels Merged
    site_name_label
    		principal.resource.attribute.labels Merged
    transaction_id_label
    		principal.resource.attribute.labels Merged
    cyolosubjectkind
    		principal.resource.resource_subtype Directly mapped
    credentials_id_label
    		principal.user.attribute.labels Merged
    credentials_name_label
    		principal.user.attribute.labels Merged
    credentials_origin_label
    		principal.user.attribute.labels Merged
    cyolosubjectid
    		principal.user.product_object_id Directly mapped
    subject_id
    		principal.user.product_object_id Directly mapped
    syslog_session_id
    		principal.user.product_object_id Directly mapped
    cyolosubjectname
    		principal.user.userid Directly mapped
    subject_name
    		principal.user.userid Directly mapped
    syslog_id
    		principal.user.userid Directly mapped
    action
    		security_result.action Merged
    result
    		security_result.action Mapped: failure → sr_action , success → sr_action
    sr_action
    		security_result.action Merged
    syslog_result
    		security_result.action_details Directly mapped
    _field
    		security_result.detection_fields Merged
    field
    		security_result.detection_fields Merged
    key
    		security_result.detection_fields Mapped: "cyoloauthkind", "cyolokind","cyoloresult" → _field
    result
    		security_result.outcome Mapped: failure → FAIL , success → PASS
    authority_id
    		security_result.rule_id Directly mapped
    cyoloauthid
    		security_result.rule_id Directly mapped
    authority_name
    		security_result.rule_name Directly mapped
    cyoloauthname
    		security_result.rule_name Directly mapped
    severity
    		security_result.severity Mapped: 1 → LOW
    cyoloobjname
    		target.application Directly mapped
    object_name
    		target.application Directly mapped
    asset_id
    		target.asset.asset_id Directly mapped
    destination_host
    		target.asset.hostname Directly mapped
    dst
    		target.asset.ip Merged
    asset_name
    		target.asset.product_object_id Directly mapped
    destination_host
    		target.hostname Directly mapped
    dst
    		target.ip Merged
    destination_port
    		target.port Directly mapped
    _field
    		target.resource.attribute.labels Merged
    key
    		target.resource.attribute.labels Mapped: cyolodstid → _field
    cyoloobjid
    		target.resource.product_object_id Directly mapped
    object_id
    		target.resource.product_object_id Directly mapped
    cyoloobjkind
    		target.resource.resource_subtype Directly mapped
    syslog_subject_name
    		target.user.userid Directly mapped
    N/A
    		 extensions.auth.type Constant: MACHINE
    N/A
    		 metadata.product_name Constant: CYOLO_OT
    N/A
    		 metadata.vendor_name Constant: CYOLO_OT
    N/A
    		 network.application_protocol Constant: RDP
    N/A
    		 network.http.parsed_user_agent Constant: parseduseragent
    N/A
    		 security_result.outcome Constant: FAIL
    N/A
    		 security_result.severity Constant: LOW

    Need more help? Get answers from Community members and Google SecOps professionals.

    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: