无HTTPS监听器的SIEM平台通用集成方案

在继续之前，您需要满足以下先决条件：

GravityZone 云平台仅向支持HTTPS的连接器发送推送事件消息。要使连接器服务通过HTTPS运行，并与 Bitdefender 云建立安全通信，需为其配置SSL/TLS证书。

默认情况下， config.sh 脚本会为HTTPS连接器服务器创建自签名证书。您还可以通过以下方式获取该服务的SSL/TLS证书：

接下来，您需要 sslkey.pem 和 ssl.cer / ssl.crt 文件（需由您选择的CA机构签发）。

使用以下HTTPS消息示例测试您刚配置的连接器：

HTTPS收集器服务已启动并监听消息后，您可配置 控制中心 将事件发送至上述定义的URL： https://your_web_server_hostname_or_public_IP:port/api .

事件推送服务API的所有设置均通过 setPushEventSettings 方法配置。有关这些设置的详细信息，请参阅 推送 .

使用您选择的API密钥，配置API推送事件及消息接收的服务URL：

$ curl --tlsv1.2 -sS -k -X POST \https://CONTROL_CENTER_APIs_ACCESS_URL/v1.0/jsonrpc/push \-H 'authorization: Basic API_KEY_BASE64_ENCODED_WITH_COLON_APPENDED' \-H 'cache-control: no-cache' \-H 'content-type: application/json' \-d '{"id":"1","jsonrpc":"2.0","method":"setPushEventSettings","params":{"serviceSettings":{"requireValidSslCertificate":false,"authorization":"Basic xxxxxxxxxx","url":" https://your_web_server_hostname_or_public_IP:port/api"},"serviceType":"cef","status":1,"subscribeToEventTypes":{"adcloudgz":true,"antiexploit":true,"aph":true,"av":true,"avc":true,"dp":true,"endpoint-moved-in":true,"endpoint-moved-out":true,"exchange-malware":true,"exchange-user-credentials":true,"fw":true,"hd":true,"hwid-change":true,"install":true,"modules":true,"network-monitor":true,"network-sandboxing":true,"new-incident":true,"ransomware-mitigation":true,"registration":true,"supa-update-status":true,"sva":true,"sva-load":true,"task-status":true,"troubleshooting-activity":true,"uc":true,"uninstall":true}}}'

配置完成后，请等待约10分钟使设置生效，然后使用 getPushEventSettings .

$ curl --tlsv1.2 -sS -k -X POST \https://CONTROL_CENTER_APIs_ACCESS_URL/v1.0/jsonrpc/push \-H 'authorization: Basic API_KEY_BASE64_ENCODED' \-H 'cache-control: no-cache' \-H 'content-type: application/json' \-d '{"id":"3","jsonrpc":"2.0","method":"getPushEventSettings","params":{}}'

返回结果应如下所示：

{  "id": "2",  "jsonrpc": "2.0",  "result": {    "serviceSettings": {      "authorization": "********",      "requireValidSslCertificate": false,      "url": "https://your_web_server_hostname_or_public_IP:port/api"    },    "serviceType": "cef",    "status": 1,    "subscribeToCompanies": null,    "subscribeToEventTypes": {      "adcloud": false,      "antiexploit": true,      "aph": true,      "av": true,      ……….      "uninstall": true    }  }}

要发送测试事件，可调用 sendTestPushEvent API方法。

$ curl --tlsv1.2 -sS -k -X POST \https://CONTROL_CENTER_APIs_ACCESS_URL/v1.0/jsonrpc/push \-H 'authorization: Basic API_KEY_BASE64_ENCODED' \-H 'cache-control: no-cache' \-H 'content-type: application/json' \-d '{"id":"4","jsonrpc":"2.0","method":"sendTestPushEvent","params":{"eventType": "av"}}'

返回结果应如下所示：

{  "id": "4",  "jsonrpc": "2.0",  "result": {    "computer_name": "FC-WIN7-X64-01",    "computer_fqdn": "fc-win7-x64-01",    "computer_ip": "10.17.46.196",    "computer_id": "59a1604e60369e06733f8abb",    "product_installed": "BEST",    "malware_type": "file",    "malware_name": "EICAR测试文件(非病毒)",    "file_path": "C:\\eicar0000001.txt",    "hash": "8b3f191819931d1f2cef7289239b5f77c00b079847b9c2636e56854d1e5eff71",    "final_status": "已删除",    "timestamp": "2017-09-08T12:01:36.000Z",    "companyId": "5ac8460f8a799399a78b456c",    "module": "av",    "_testEvent_": true  }}

该事件将很快出现在Syslog服务器及 server.js 输出中。

日志文件路径：

/opt/bitdefender/var/log/gz-evpsc/log.txt