Console
    Start free

    Collect Ivanti Neurons for MDM (formerly MobileIron) logs

    Supported in:

    This document explains how to ingest Ivanti Neurons for MDM (formerly known as MobileIron) logs to Google Security Operations using Bindplane.

    Ivanti Neurons for MDM is a unified endpoint management (UEM) platform that enables organizations to secure and manage mobile devices, applications, and content across iOS, Android, macOS, and Windows environments. It provides device enrollment, policy enforcement, compliance monitoring, app distribution, and threat detection capabilities for enterprise mobility management.

    Before you begin

    Make sure you have the following prerequisites:

    • A Google SecOps instance.
    • A Windows 2016 or later or Linux host with systemd.
    • If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements.
    • Privileged access to the Ivanti Neurons for MDM admin console.

    Get Google SecOps ingestion authentication file

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Collection Agents.
    3. Download the Ingestion Authentication File.
      • Save the file securely on the system where Bindplane will be installed.

    Get Google SecOps customer ID

    1. Sign in to the Google SecOps console.
    2. Go to SIEM Settings > Profile.
    3. Copy and save the Customer IDfrom the Organization Detailssection.

    Install the Bindplane agent

    Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

    Windows installation

    1. Open the Command Promptor PowerShellas an administrator.

    2. Run the following command:

        msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet

    Linux installation

    1. Open a terminal with root or sudo privileges.

    2. Run the following command:

       sudo  
sh  
-c  
 " 
 $( 
curl  
-fsSlL  
https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh ) 
 " 
  
install_unix.sh

    Additional installation resources

    For additional installation options, consult this installation guide .

    Configure the Bindplane agent to ingest Syslog and send to Google SecOps

    1. Access the configuration file:

      • Locate the config.yaml file. Typically, it's in the /observiq-otel-collector/ directory on Linux or in the installation directory on Windows.
      • Open the file using a text editor (for example, nano , vi , or Notepad).

    2. Edit the config.yaml file as follows:

        receivers 
 : 
  
 tcplog 
 : 
  
 listen_address 
 : 
  
 "0.0.0.0:514" 
 exporters 
 : 
  
 chronicle/chronicle_w_labels 
 : 
  
 compression 
 : 
  
 gzip 
  
 creds_file_path 
 : 
  
 '/path/to/ingestion-authentication-file.json' 
  
 customer_id 
 : 
  
 '<customer_id>' 
  
 endpoint 
 : 
  
 malachiteingestion-pa.googleapis.com 
  
 log_type 
 : 
  
 MOBILEIRON 
  
 raw_log_field 
 : 
  
 body 
  
 ingestion_labels 
 : 
 service 
 : 
  
 pipelines 
 : 
  
 logs/source0__chronicle_w_labels-0 
 : 
  
 receivers 
 : 
  
 - 
  
 tcplog 
  
 exporters 
 : 
  
 - 
  
 chronicle/chronicle_w_labels
    • Replace the port and IP address as required in your infrastructure.
    • Replace <customer_id> with the actual Customer ID.
    • Update /path/to/ingestion-authentication-file.json to the file path where the authentication file was saved in the Get Google SecOps ingestion authentication filestep.

    Restart the Bindplane agent to apply the changes

    To restart the Bindplane agent in Linux:

    1. Run the following command:

       sudo  
systemctl  
restart  
observiq-otel-collector

    2. Verify the service is running:

       sudo  
systemctl  
status  
observiq-otel-collector

    3. Check logs for errors:

       sudo  
journalctl  
-u  
observiq-otel-collector  
-f

    To restart the Bindplane agent in Windows:

    1. Choose one of the following options:

      • Command Prompt or PowerShell as administrator:
       net stop observiq-otel-collector && net start observiq-otel-collector
      • Services console:
        1. Press Win+R , type services.msc , and press Enter.
        2. Locate observIQ OpenTelemetry Collector.
        3. Right-click and select Restart.

    2. Verify the service is running:

       sc query observiq-otel-collector

    3. Check logs for errors:

        type 
  
 "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"

    Configure Ivanti Neurons for MDM syslog forwarding

    1. Sign in to the Ivanti Neurons for MDMadmin console.
    2. Go to Settings > Syslog.
    3. Click Addto create a new syslog configuration.
    4. Provide the following configuration details:
      • Host: Enter the IP address of the Bindplane agent host.
      • Port: Enter 514 .
      • Protocol: Select TCP.
    5. In the Event Typessection, select the event categories to forward:
      • Device events
      • Compliance events
      • Security events
      • Admin events

    6. Click Saveto apply the syslog configuration.

    UDM mapping table

    Log Field UDM Mapping Logic
    COMMAND_label
    		additional.fields Merged
    NI_label
    		additional.fields Merged
    PR_label
    		additional.fields Merged
    RES_label
    		additional.fields Merged
    SHR_label
    		additional.fields Merged
    S_label
    		additional.fields Merged
    SystemType_label
    		additional.fields Merged
    VIRT_label
    		additional.fields Merged
    apache_error_code_label
    		additional.fields Merged
    attempts_label
    		additional.fields Merged
    b_label
    		additional.fields Merged
    bi_label
    		additional.fields Merged
    bo_label
    		additional.fields Merged
    buff_label
    		additional.fields Merged
    cache_label
    		additional.fields Merged
    cpuTIME_label
    		additional.fields Merged
    cpu_percent_label
    		additional.fields Merged
    cs_label
    		additional.fields Merged
    duration_ms_label
    		additional.fields Merged
    error_code_label
    		additional.fields Merged
    free_label
    		additional.fields Merged
    in_label
    		additional.fields Merged
    ip_in_bracket_label
    		additional.fields Merged
    log_year_label
    		additional.fields Merged
    mem_percent_label
    		additional.fields Merged
    module_label
    		additional.fields Merged
    ns_1_label
    		additional.fields Merged
    pctCPU_label
    		additional.fields Merged
    pctMEM_label
    		additional.fields Merged
    product_label
    		additional.fields Merged
    r_label
    		additional.fields Merged
    rss_label
    		additional.fields Merged
    safepoint_ns_1_label
    		additional.fields Merged
    safepoint_ns_2_label
    		additional.fields Merged
    si_label
    		additional.fields Merged
    so_label
    		additional.fields Merged
    st_label
    		additional.fields Merged
    start_label
    		additional.fields Merged
    stat_label
    		additional.fields Merged
    swpd_label
    		additional.fields Merged
    sy_label
    		additional.fields Merged
    t1_label
    		additional.fields Merged
    tag_label
    		additional.fields Merged
    token_id_label
    		additional.fields Merged
    us_label
    		additional.fields Merged
    vsz_label
    		additional.fields Merged
    wa_label
    		additional.fields Merged
    has_target_user
    		extensions.auth.type Mapped: true → MACHINE
    host
    		intermediary.asset.hostname Directly mapped
    host
    		intermediary.hostname Directly mapped
    ip_1
    		intermediary.ip Merged
    desc
    		metadata.description Directly mapped
    kv_msg
    		metadata.description Directly mapped
    msg
    		metadata.description Directly mapped
    date_time
    		metadata.event_timestamp Parsed as yyyy-MM-dd--HH-mm-ss
    policyViolatedAt
    		metadata.event_timestamp Parsed as UNIX_MS
    time
    		metadata.event_timestamp Parsed as yyyy-MM-ddTHH:mm:ss.SSS+0000
    time_1
    		metadata.event_timestamp Parsed as UNIX
    timestamp
    		metadata.event_timestamp Parsed as yyyy-MM-ddTHH:mm:ss.SSSSSS+00:00
    ts
    		metadata.event_timestamp Parsed as MMM DD HH:mm:ss
    action
    		metadata.event_type Mapped: Started Session → USER_UNCATEGORIZED
    has_resource
    		metadata.event_type Mapped: true → USER_RESOURCE_ACCESS
    has_target_user
    		metadata.event_type Mapped: true → USER_LOGOUT
    principal_mid_present
    		metadata.event_type Mapped: true → NETWORK_CONNECTION , true → STATUS_UPDATE
    msgid
    		metadata.product_log_id Directly mapped
    version
    		metadata.product_version Directly mapped
    protocol
    		network.application_protocol Directly mapped
    protocol_version
    		network.application_protocol_version Directly mapped
    http_method
    		network.http.method Directly mapped
    method
    		network.http.method Directly mapped
    referrer
    		network.http.referral_url Directly mapped
    url
    		network.http.referral_url Directly mapped
    http_status
    		network.http.response_code Renamed/mapped
    user_agent
    		network.http.user_agent Directly mapped
    response_size
    		network.received_bytes Renamed/mapped
    sessionId
    		network.session_id Directly mapped
    cipher
    		network.tls.cipher Directly mapped
    tls_version
    		network.tls.version Directly mapped
    app_name
    		principal.application Directly mapped
    hardware
    		principal.asset.hardware Merged
    client_ip
    		principal.asset.ip Merged
    src_ip
    		principal.asset.ip Merged
    platformType
    		principal.asset.platform_software.platform Mapped: (?i)Windows → WINDOWS , (?i)(MAC/OS X/IOS) → MAC , (?i)Linux → LINUX
    platformType
    		principal.asset.platform_software.platform_version Directly mapped
    platformVersion
    		principal.asset.platform_software.platform_version Directly mapped
    id
    		principal.asset.product_object_id Directly mapped
    client_ip
    		principal.ip Merged
    src_ip
    		principal.ip Merged
    client_port
    		principal.port Directly mapped
    PID
    		principal.process.pid Directly mapped
    procid
    		principal.process.pid Directly mapped
    idle_label
    		principal.resource.attribute.labels Merged
    iowait_label
    		principal.resource.attribute.labels Merged
    nice_label
    		principal.resource.attribute.labels Merged
    steal_label
    		principal.resource.attribute.labels Merged
    system_label
    		principal.resource.attribute.labels Merged
    user_label
    		principal.resource.attribute.labels Merged
    emailAddress
    		principal.user.email_addresses Merged
    firstName
    		principal.user.first_name Directly mapped
    lastName
    		principal.user.last_name Directly mapped
    displayName
    		principal.user.user_display_name Directly mapped
    USER
    		principal.user.userid Directly mapped
    username
    		principal.user.userid Directly mapped
    policy_Violated_At
    		security_result.about.labels Merged
    sr_action
    		security_result.action Merged
    category
    		security_result.category Merged
    complianceViolationTypeToReason.BLACKLIST_APPS
    		security_result.description Directly mapped
    complianceViolationTypeToReason.PC
    		security_result.description Directly mapped
    complianceViolationTypeToReason.SA
    		security_result.description Directly mapped
    description
    		security_result.description Directly mapped
    http_request_label
    		security_result.detection_fields Merged
    run_user_label
    		security_result.detection_fields Merged
    safepoint_type_label
    		security_result.detection_fields Merged
    systemd_user_label
    		security_result.detection_fields Merged
    type_label
    		security_result.detection_fields Merged
    policyViolatedID
    		security_result.rule_id Directly mapped
    loglevel
    		security_result.severity Mapped: (?i)INFO → INFORMATIONAL , (?i)Error → ERROR , (?i)Warning → MEDIUM
    loglevel
    		security_result.severity_details Directly mapped
    summary
    		security_result.summary Directly mapped
    target_ip
    		target.asset.ip Merged
    target_host
    		target.hostname Directly mapped
    target_ip
    		target.ip Merged
    target_port
    		target.port Directly mapped
    command
    		target.process.command_line Directly mapped
    pid
    		target.process.pid Directly mapped
    program_name
    		target.resource.name Directly mapped
    url_1
    		target.url Directly mapped
    session_user
    		target.user.userid Directly mapped
    N/A
    		 extensions.auth.type Constant: MACHINE
    N/A
    		 metadata.event_type Constant: USER_LOGOUT
    N/A
    		 metadata.product_name Constant: Endpoint Manager Mobile
    N/A
    		 metadata.vendor_name Constant: Ivanti
    N/A
    		 principal.asset.platform_software.platform Constant: WINDOWS
    N/A
    		 principal.asset.type Constant: MOBILE
    N/A
    		 security_result.severity Constant: INFORMATIONAL

    Change Log

    View the Change Log for this parser

    Need more help? Get answers from Community members and Google SecOps professionals.

    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: