@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
md 62 lines 3.59 KB
Rendered Raw
1 # [BitDefender Integration](https://www.bitdefender.com/business/support/en/77209-144080-build-an-event-push-service-api-connector-for-cef-standard.html)
2
3 ## Prerequisites
4
5 Before using the GravityZone Event Push Service API Connector, you’ll want to first define the API client and set its scope. Refer to this guide (https://www.bitdefender.com/business/support/en/77209-125277-public-api.html?srsltid=AfmBOooClMFH-dCfndiVD6eDNTBM5Q13qoFafF04EO3EsdJBPIbm--kx) to getting access to the BitDefender API for setting up a new API client key. For the new API client, make sure the scope includes read access for Event streams.
6
7 ![BitDefender API Settings](/images/bitdefender/bitdefender_api_key.png)
8
9 ### Firewall Configuration
10
11 The connector uses the POST method to receive authenticated and secured messages from the GravityZone Event Push Service. It parses the message and then forwards it to a local or a remote Syslog server. You can use the Syslog server to feed these messages to the SIEM. This means that the connector must be able to receive messages from the GravityZone Event Push Service and send them to the Graylog server. Make sure that the firewall allows the connector to receive messages from the GravityZone Event Push Service and send them to the Graylog server.
12
13 What we will be deploying is an HTTP endpoint that will receive the BitDefender logs and forward them to a syslog server. The HTTP endpoint is running on the server running CoPilot and will be listening on the port that you will define. This means that we must configure public DNS records to point to your edge firewall and open the port that you will define in the firewall.
14
15 Traffic flow will be as follows:
16 BitDefender Cloud Platform _ Your Edge Firewall _ CoPilot Server \_ Graylog Server
17
18 ## Configuration
19
20 The configuration for our API creds and syslog forwarder settings are stored within `/opt/bitdefender/gz-evpsc/api/config/config.json`. Adjust to make your changes. **NOTE that the `port` , `syslog_port` , `target` , and `authentication_string` will need to be updated.** Below is an example, CoPilot will take care of this for you.
21
22 ```json
23 {
24 "port": 3200,
25 "syslog_port": 10514,
26 "transport": "Tcp",
27 "target": "YOUR_GRAYLOG_SERVER",
28 "authentication_string": "Basic cmVsaWFibGVwYnhfYml0ZGVmZW5kZXI6cmVsaWFibGVwYnhfYml0ZGVmZW5kZXI=",
29 "secure": {
30 "enabled": true,
31 "key": "api/config/server.key",
32 "cert": "api/config/server.crt"
33 }
34 }
35 ```
36
37 ## Provisioning
38
39 Once you have saved the BitDefender configuration for the customer, you are ready to deploy the integration. Navigate to the `Customers` tab and select the appropriate customer. The provisiong creates the necessary:
40
41 - Graylog CEF Input
42 - Graylog Stream
43 - Graylog Index
44 - Grafana Datasource
45 - Grafana Dashboards
46 - BitDefender Docker-Compose File
47
48 ## Deployment of BitDefender Container
49
50 The BitDefender integration runs via a docker container. During provisioning, the following directory is created `/opt/CoPilot/data/data/CUSTOMER_NAME`. Within this directory will reside the `CUSTOMER_NAME_bitdefender_docker-compose.yml` and the `config.json` files. These can be modified if desired but should already contain the details needed to collect logs for their BitDefender environment.
51
52 Start the container with the below command:
53
54 ```bash
55 docker compose -f /opt/CoPilot/data/data/CUSTOMER_NAME/CUSTOMER_NAME_bitdefender_docker-compose.yml up -d
56 ```
57
58 You should now see the container running.
59
60 ## Test the Connector
61
62 [Helpful Doc For Testing](https://support.netenrich.com/hc/en-us/articles/10833633251869-Bitdefender-Gravity-Zone-Cloud-integration#:~:text=155.173,Configure%20Chronicle%20Forwarder)