The application consist of the following components:

1. Dashboard Package
   
   • LP_Airlock WAF 
2. Normalization Packages
   
   • LP_Airlock WAF 
   • LP_Airlock WAF Generic 
   • LP_Airlock WAF Process 
3. Label Package
   
   • LP_Airlock WAF 

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

Installation

Follow these steps to install the Airlock v5.0.0 plugin:

1. Download the Airlock package from the Download section above.
2. Add the required Airlock as a device in LogPoint.
3. Create a collection policy with the Syslog collector and appropriate processing policy. 
4. Assign the policy to the device.
5. Add the dashboard.

Supported Version

The supported version of Airlock with LogPoint in this configuration is:

• Airlock WAF v6.0

Log Format

Expected Log Format

Airlock WAF 

Log Sample

Feb 1 09:17:16 airlock System: Feb 1 09:17:16 @Kxxxx---4xx--- Security sshd[xxxxx]: [authxxxx.info] Accepted password for xxxxx from xxx.xxx.x.xx port 1234 ssh2