从 GravityZone 云平台向缺乏HTTPS监听器的SIEM系统发送事件

继续操作前，需满足以下先决条件：

GravityZone 云平台仅向支持HTTPS的连接器发送推送事件消息。要使连接器服务通过HTTPS运行，并与 Bitdefender 云建立安全通信，需配置SSL/TLS证书。

默认情况下， config.sh 脚本会为HTTPS连接器服务器创建自签名证书。您还可以通过以下方式获取该服务的SSL/TLS证书：

后续操作中，您将需要 sslkey.pem 以及 ssl.cer / ssl.crt 文件，这些文件应由您选择的CA签署。

使用以下HTTPS消息示例测试您刚刚配置的连接器：

HTTPS收集器服务已启动并正在监听消息，您现在可以 配置 控制中心 将事件发送至上述定义的URL： https://您的Web服务器主机名或公网IP:端口/api .

事件推送服务API的所有设置均通过 setPushEventSettings 方法配置。有关这些设置的详细信息，请参阅 推送 .

使用您选择的API密钥，配置API推送事件及消息接收的服务URL：

$ curl --tlsv1.2 -sS -k -X POST \
https://CONTROL_CENTER_APIs_ACCESS_URL/v1.0/jsonrpc/push \
-H 'authorization: Basic API_KEY_BASE64_ENCODED_WITH_COLON_APPENDED' \
-H 'cache-control: no-cache' \
-H 'content-type: application/json' \
-d '{"id":"1","jsonrpc":"2.0","method":"setPushEventSettings","params":{"serviceSettings":{"requireValidSslCertificate":false,"authorization":"Basic xxxxxxxxxx","url":" https://your_web_server_hostname_or_public_IP:port/api"},"serviceType":"cef","status":1,"subscribeToEventTypes":{"adcloudgz":true,"antiexploit":true,"aph":true,"av":true,"avc":true,"dp":true,"endpoint-moved-in":true,"endpoint-moved-out":true,"exchange-malware":true,"exchange-user-credentials":true,"fw":true,"hd":true,"hwid-change":true,"install":true,"modules":true,"network-monitor":true,"network-sandboxing":true,"new-incident":true,"ransomware-mitigation":true,"registration":true,"supa-update-status":true,"sva":true,"sva-load":true,"task-status":true,"troubleshooting-activity":true,"uc":true,"uninstall":true}}}'

配置完成后，请等待约10分钟使设置生效，然后使用 getPushEventSettings .

$ curl --tlsv1.2 -sS -k -X POST \
https://CONTROL_CENTER_APIs_ACCESS_URL/v1.0/jsonrpc/push \
-H 'authorization: Basic API_KEY_BASE64_ENCODED' \
-H 'cache-control: no-cache' \
-H 'content-type: application/json' \
-d '{"id":"3","jsonrpc":"2.0","method":"getPushEventSettings","params":{}}'

返回结果应如下所示：

{
  "id": "2",
  "jsonrpc": "2.0",
  "result": {
    "serviceSettings": {
      "authorization": "********",
      "requireValidSslCertificate": false,
      "url": "https://your_web_server_hostname_or_public_IP:port/api"
    },
    "serviceType": "cef",
    "status": 1,
    "subscribeToCompanies": null,
    "subscribeToEventTypes": {
      "adcloud": false,
      "antiexploit": true,
      "aph": true,
      "av": true,
      ……….
      "uninstall": true
    }
  }
}

要发送测试事件，可调用 sendTestPushEvent API方法。

$ curl --tlsv1.2 -sS -k -X POST \
https://CONTROL_CENTER_APIs_ACCESS_URL/v1.0/jsonrpc/push \
-H 'authorization: Basic API_KEY_BASE64_ENCODED' \
-H 'cache-control: no-cache' \
-H 'content-type: application/json' \
-d '{"id":"4","jsonrpc":"2.0","method":"sendTestPushEvent","params":{"eventType": "av"}}'

返回结果应如下所示：

{
  "id": "4",
  "jsonrpc": "2.0",
  "result": {
    "computer_name": "FC-WIN7-X64-01",
    "computer_fqdn": "fc-win7-x64-01",
    "computer_ip": "10.17.46.196",
    "computer_id": "59a1604e60369e06733f8abb",
    "product_installed": "BEST",
    "malware_type": "file",
    "malware_name": "EICAR测试文件(非病毒)",
    "file_path": "C:\\eicar0000001.txt",
    "hash": "8b3f191819931d1f2cef7289239b5f77c00b079847b9c2636e56854d1e5eff71",
    "final_status": "已删除",
    "timestamp": "2017-09-08T12:01:36.000Z",
    "companyId": "5ac8460f8a799399a78b456c",
    "module": "av",
    "_testEvent_": true
  }
}

该事件将很快出现在Syslog服务器及 server.js 输出中。

日志文件路径：

/opt/bitdefender/var/log/gz-evpsc/log.txt