Single Sensor Multi-tenant Log Ingestion
For multi-tenant deployments, you typically configure a single modular sensor to ingest logs from separate tenants. Optionally, you can consolidate this task to a single sensor. The details below identify which vendors log files are currently supported for this feature, along with the associated configuration steps.
Requirements
The capability for this feature must be specifically enabled. As of v4.3.1 the functionality is off by default and must be toggled on in the Sensor Profile. To enable it, access the Log Forwarder section of your Standard Sensor profile, then locate the toggle for Multi-Tenant Log Ingestion. After it is enabled, you can send data from the following vendors:
-
These include the Tenant ID field needed to support this feature:
-
Infocyte (CEF), port 5143
-
Blackberry Cylance, port 5177
-
-
These are supported for use on port 5564 if submitted in the Stellar JSON format indicated below.
-
Palo Alto Networks Firewall (syslog, cef, leef)
-
SonicWall Firewall (syslog or cef)
-
Cisco Meraki (syslog)
-
Fortinet Fortigate (syslog)
-
Stellar JSON Format for Multi-Tenant Parsing
This required format consists of four parts:
-
stellar: This required field is used to specify that the file is in Stellar Cyber format.
-
tenantid: Specify the tenant ID. If this value is not present, the Tenant ID associated with the sensor is used.
-
msg_origin: This wrapper label is required for parsing on the multi-tenant port. Use the following table for guidance with the relevant fields.
Vendor
Product
Format
palo_alto_networks
firewall
syslog
cef
leef
sonicwall
firewall
syslog
cef
cisco
meraki
syslog
fortinet
fortigate
syslog
-
vendor and product: Both of these values in the msg_origin block are required. They are used to identify which Stellar Cyber parser will handle the original log
-
format: If this value is not present, syslog is used
-
srcip: This value should be the IP address of the original log source. It is optional, but including it results in better log ingestion statistics.
-
-
parser_raw_msg: If this required content is missing, the record is discarded.
Since the raw data is wrapped in double quotes, ensure that the pre-processor you use to create this record injects an escape before all double quotes in the original log file.
The field labels are illustrated here:
{ "stellar": { "tenantid": " ", "msg_origin": { "vendor": " ", "product": " ", "format": " ", "srcip": " " } }, "parser_raw_msg":" " }
An example Stellar JSON record is shown here (data is truncated)
{ "stellar": { "tenantid": "12345678", "msg_origin": { "vendor": "palo_alto_networks", "product": "firewall", "format": "syslog", "srcip": "192.168.100.74" } }, "parser_raw_msg":"<134>Nov 11 2020 21:55:21 ..." }