IBoss
ArchivedThe IBoss application normalizes IBoss events. You can further customize the searches to perform in-depth analysis.
Release Details
Package Details
- Normalization Package
- LP_iBoss URL Filtering Appliance
- Compiled Normalizer
- IBossCompiledNormalizer
Enhancement
Installation
Follow these steps to install the IBoss v5.0.1 application:
- Download the IBoss package from the Download section above.
- Add IBoss as the required device in LogPoint.
- Create a collection policy with the Syslog collector and appropriate processing policy.
- Assign the policy to the device.
- Add the dashboard.
Past Release
For LogPoint v6.0.0 to v6.6.6 ▾
Enhancement
Log Format
Expected Log Format
Key = Value pair separated by a delimiter
Log Samples
<14>Jan 24 10:03:45 abc.com Wed Jan 24 10:02:42 GMT 2018,URL_LOG_ENTRY,URL_LOG_ID=3374206,BYTES=0,CONTENT_TYPE=1,ACTION=Allowed,URL=t0.ssl.dk.mno.pqrs.abc.net,CATEGORIES=20,IPADDR=88.88.88.88,COMP_MAC=00:00:00:00:00:00,COMP_NAME=EMPTY,LOC=EMPTY,SRC_IPADDR=10.10.10.10,CALLOUT=0,REPORT_GROUP=0,STATUS=0,STEALTH=0,QOS_EVENT=0,AUDIT=0,IBOSS=iboss1,MALWARE=0,CNC_FLAG=0,AVSCANNED=0,CATEGORIES_NAMES=Travel,REQUEST_METHOD=aaa,USER_AGENT=aa,
URL_LOG_ENTRY URL_LOG_ID=2987356 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=https://www.xyz.com
URL_LOG_ENTRY URL_LOG_ID=4074292 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=xyz.com CATEGORIES=35,36,39 IPADDR=1.1.1.1 COMP_MAC=00:00:00:00:00:00 COMP_NAME=WCE-ACCT-01 LOC=EMPTY SRC_IPADDR=1.1.1.2 CALLOUT=0 REPORT_GROUP=0 STATUS=0 STEALTH=0 QOS_EVENT=0 AUDIT=0 IBOSS=iboss1 MALWARE=0 CNC_FLAG=0 AVSCANNED=0 CATEGORIES_NAMES=Business,Web Hosting,Technology
To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.