Console
    Start free

    Collect Avatier logs

    Supported in:

    This document explains how to ingest Avatier logs to Google Security Operations using the Bindplane agent.

    Avatier Identity Management Suite (AIMS) is an identity governance platform that generates logs for user access events, authentication, provisioning, and security operations. The parser extracts key-value pairs from syslog messages and maps them to the Unified Data Model (UDM).

    Before you begin

    Make sure you have the following prerequisites:

    • A Google SecOps instance
    • Windows Server 2016 or later, or Linux host with systemd
    • Network connectivity between the Bindplane agent and the Avatier AIMS server
    • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements
    • Privileged access to Avatier Identity Management

    Get Google SecOps ingestion authentication file

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Collection Agents.

    3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

    Get Google SecOps customer ID

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Profile.

    3. Copy and save the Customer IDfrom the Organization Detailssection.

    Install the Bindplane agent

    Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

    Windows installation

    1. Open Command Promptor PowerShellas an administrator.

    2. Run the following command:

        msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sc query observiq-otel-collector

      The service should show as RUNNING.

    Linux installation

    1. Open a terminal with root or sudo privileges.

    2. Run the following command:

       sudo  
sh  
-c  
 " 
 $( 
curl  
-fsSlL  
https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
 " 
  
install_unix.sh

    3. Wait for the installation to complete.

    4. Verify the installation by running:

       sudo  
systemctl  
status  
observiq-otel-collector

      The service should show as active (running).

    Additional installation resources

    For additional installation options and troubleshooting, see Bindplane agent installation guide .

    Configure the Bindplane agent to ingest syslog and send to Google SecOps

    Locate the configuration file

    • Linux:

       sudo  
nano  
/etc/bindplane-agent/config.yaml

    • Windows:

       notepad "C:\Program Files\observIQ OpenTelemetry Collector\config.yaml"

    Edit the configuration file

    • Replace the entire contents of config.yaml with the following configuration:

        receivers 
 : 
  
 udplog 
 : 
  
 listen_address 
 : 
  
 "0.0.0.0:514" 
 exporters 
 : 
  
 chronicle/avatier 
 : 
  
 compression 
 : 
  
 gzip 
  
 creds_file_path 
 : 
  
 '/etc/bindplane-agent/ingestion-auth.json' 
  
 customer_id 
 : 
  
 '<customer_id>' 
  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 log_type 
 : 
  
 AVATIER 
  
 raw_log_field 
 : 
  
 body 
 service 
 : 
  
 pipelines 
 : 
  
 logs/avatier_to_chronicle 
 : 
  
 receivers 
 : 
  
 - 
  
 udplog 
  
 exporters 
 : 
  
 - 
  
 chronicle/avatier

    Configuration parameters

    Replace the following placeholders:

    • Receiver configuration:

      • listen_address : IP address and port to listen on:
        • 0.0.0.0 to listen on all interfaces (recommended)
        • Port 514 is the standard syslog port (requires root on Linux; use 1514 for non-root)

    • Exporter configuration:

      • creds_file_path : Full path to ingestion authentication file:
        • Linux: /etc/bindplane-agent/ingestion-auth.json
        • Windows: C:\Program Files\observIQ OpenTelemetry Collector\ingestion-auth.json
      • customer_id : Customer ID copied from the Google SecOps console
      • endpoint : Regional endpoint URL:
        • US: malachiteingestion-pa.googleapis.com
        • Europe: europe-malachiteingestion-pa.googleapis.com
        • Asia: asia-southeast1-malachiteingestion-pa.googleapis.com
        • See Regional Endpoints for complete list

    Save the configuration file

    • After editing, save the file:
      • Linux: Press Ctrl+O , then Enter , then Ctrl+X
      • Windows: Click File > Save

    Restart the Bindplane agent to apply the changes

    • To restart the Bindplane agent in Linux, run the following command:

       sudo  
systemctl  
restart  
observiq-otel-collector

      1. Verify the service is running:

         ```bash
sudo systemctl status observiq-otel-collector
```

      2. Check logs for errors:

         ```bash
sudo journalctl -u observiq-otel-collector -f
```

    • To restart the Bindplane agent in Windows, choose one of the following options:

      • Command Prompt or PowerShell as administrator:

         net stop observiq-otel-collector && net start observiq-otel-collector

      • Services console:

        1. Press Win+R , type services.msc , and press Enter.
        2. Locate observIQ OpenTelemetry Collector.
        3. Right-click and select Restart.

        4. Verify the service is running:

           sc query observiq-otel-collector

        5. Check logs for errors:

            type 
  
 "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

    Configure syslog for Avatier (AIMS)

    1. Sign in to the AIMS Configurationweb UI.
    2. Select Avatier Identity Management Suite > SIEM.
    3. Provide the following configuration details:
      • Select the Enablecheckbox for the SIEM integration.
      • Server: Enter the Bindplane agent IP address.
      • UDP Port: Enter the Bindplane agent port number.
      • Select the Enabledcheckbox near each Field Typeto export.
    4. Click Save.

    UDM mapping table

    Log Field UDM Mapping Logic
    auth_mechanism
    		extensions.auth.mechanism Merged
    event_type
    		extensions.auth.type Mapped values (5 total, e.g. AuthToDomainError → SSO , AuthToDomain → SSO , PSLogin ...
    intermediary_hostname
    		intermediary.hostname Directly mapped
    intermediary_ip
    		intermediary.ip Merged
    description
    		metadata.description Directly mapped
    timestamp
    		metadata.event_timestamp Parsed as RFC 3339
    event_type
    		metadata.event_type Mapped values (20 total, e.g. SMTPError → EMAIL_TRANSACTION , `PasswordRejectedByPolicyEr...
    event_type
    		metadata.product_event_type Directly mapped
    principal_ip
    		principal.ip Merged
    au
    		principal.user.user_display_name Directly mapped
    username
    		principal.user.user_display_name Directly mapped
    au
    		principal.user.userid Directly mapped
    email
    		security_result.about.email Directly mapped
    action
    		security_result.action Merged
    category
    		security_result.category Merged
    act
    		security_result.summary Directly mapped
    Domain
    		target.administrative_domain Directly mapped
    cot
    		target.administrative_domain Directly mapped
    mapping_domain
    		target.administrative_domain Directly mapped
    hostname
    		target.hostname Directly mapped
    target_ip
    		target.ip Merged
    port
    		target.port Directly mapped
    pid
    		target.process.pid Directly mapped
    mapped_id
    		target.resource.id Directly mapped
    event_type
    		target.resource.type Mapped: (Deleted/Added)Mapping → SETTING
    un
    		target.user.user_display_name Directly mapped
    target_id
    		target.user.userid Directly mapped
    un
    		target.user.userid Directly mapped
    N/A
    		 extensions.auth.type Constant: SSO
    N/A
    		 metadata.event_type Constant: GENERIC_EVENT
    N/A
    		 metadata.product_name Constant: Avatier Identity Management Suite (AIMS)
    N/A
    		 metadata.vendor_name Constant: AVATIER
    N/A
    		 target.resource.type Constant: SETTING

    Need more help? Get answers from Community members and Google SecOps professionals.

    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: