S3 Log Storage

My OPSWAT Central Management offers an SIEM (Security Information Event Management) integration that can be found under Settings > Integrations > SIEM Integration.

When enabled, My OPSWAT Central Management utilizes the established S3 buckets through AWS (set up by the administrator) for log storage to collect analytical data about the associated account and to alert the administrators about any triggered events selected in the integration. By using the integration, administrators can track and monitor any patterns of activity that can become a potential threat to their infrastructure.

Setting up the integration

To set up the SIEM integration, administrators should proceed with the following steps:

• Log into My OPSWAT Central Management. Navigate to Settings > Integrations > SIEM Integration.
• Select Enable Log Storage.
• Fill in the required fields based on the associated AWS account (For more information on setting this up, please review here).
• Select the desired format for the logs (JSON or SYSLOG).
• Select the events that will trigger an email notification. To save this configuration, it is required to select at least one event.
• When completed, select Save.

Note: The sync of data between My OPSWAT Central Management and the S3 bucket is scheduled for every 5 minutes.

Receiving Logs

Once the initial setup is completed in My OPSWAT Central Management, administrators will be able to access their logs from their S3 bucket after a triggered event. From the S3 bucket, administrators can download logs for reviewal, auditing, or historical purposes. As mentioned above, the logs from triggered events come in two formats: JSON and SYSLOG. Administrators can select based on their preference as the contents remain the same.

JSON

{

  "log_type": "exempt_all",

  "device_name": "LTES156H",

  "device_id": "LTES156H",

  "last_seen": "2022-07-15T08:55:12.279Z",

  "device_group": "Default",

  "details": "Device LTES156H was exempted by Alice (alice@company.com) 24 hour(s)",

  "type": "Device",

  "device_username": "Wilfred Hoeger",

  "timestamp": "2022-07-15T08:55:12.279Z"

}

SYSLOG

"log_type":"config","details":"Administrator Alice (alice@company.com) changed  Settings  - Integrations - SIEM Integration ","admin_name":"Alice Bob","type":"Account","event":"Configuration Change","admin_email":"alice@company.com","timestamp":"2022-07-15T11:19:41.629Z"

Understanding Logs

Within these logs, there are key values that administrators can use when reviewing the data to further track down an affected device or account change.

Device

Account