When you configure ObserveIT to send logs through NXLog to USM Anywhere, you can use the ObserveIT plugin to translate the raw log data into normalized events for analysis.
|Device type||Unified Threat Management|
Integrating ObserveIT Logs
The USM Anywhere ObserveIT plugin leverages the integration support that ObserveIT provides for the HP ArcSight SIEM monitoring software. Follow the ObserveIT documentation to configure the SIEM Log Integration.
Important: Follow the steps closely and keep all the default values even though they contain the word "ArcSight". The NXLog configuration file that you download from AlienVault has been specified to parse logs in the default location.
Before you configure the integration, you must have the IP Address of the USM Anywhere Sensor.
To configure NXLog to send log data to USM Anywhere
The ObserverIT plugin automatically processes all messages when the raw message contains ObserveIT.
Available Plugin Fields
The following plugin fields are important attributes extracted from the syslog message. The USM Anywhere reports use these fields, and you can also reference them when creating custom reports. In addition to reporting, the USM Anywhere correlation rules make use of these fields.
- customfield_0 → EventCategory or Area or AlertDetails or SessionId
- customfield_1 → EventSource or Item or OS
- customfield_2 → EventTypeCode or Action
- customfield_3 → ConfigProprtyName
- customfield_4 → TypeOfChangeStr
- customfield_5 → NewValue
- customfield_6 → Printer
For troubleshooting, refer to the vendor documentation: