Clavister CorePlus

Release Details

Package Details

The application consists of the following components:

1. Dashboard Package
   
   • LP_Clavister CorePlus
2. Label Package
   
   • LP_Clavister CorePlus 
3. Compiled Normalizer
   • ClavisterCorePlusCompiledNormalizer

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

Installation

Follow these steps to install the Clavister CorePlus v3.5.0 application:

• Download the Clavister CorePlus package from the Download section above.
• Add Clavister CorePlus as the required device in LogPoint.
• Create a collection policy with the Syslog collector and appropriate processing policy.
• Assign the policy to the device.
• Add the dashboard.

Screenshot

Supported Device

The supported device of Clavister CorePlus with LogPoint in this configuration is:

• Clavister CorePlus v1

Log Format

Expected Log Format

Key=value pair separated by space

Log Samples

<134>[2012-04-04 13:43:27] EFW: IPSEC: prio=1 id=xxxxx rev=1 event=xauth_exchange_done statusmsg="Authentication failed"

 <134>[2012-04-04 12:20:15] EFW: IPSEC: prio=1 id=xxxxxx rev=2 event=ipsec_event message=" Remote Proxy ID 1.1.1.1/24 any"

<132>[2012-04-04 13:39:55] EFW: IPSEC: prio=3 id=xxxxx rev=1 event=ipsec_sa_failed action=no_ipsec_sa statusmsg="No proposal chosen"

<132>[2012-04-04 13:36:13] EFW: IPSEC: prio=3 id=xxxxxx rev=2 event=ipsec_sa_selection_failed action=no_ipsec_sa_selected reason="Invalid proposal" int_severity=6

<133>[2012-04-04 13:33:35] EFW: IPSEC: prio=2 id=01802300 rev=1 event=rule_selection_failed info="Quick-Mode local ID mismatch" int_severity=6

<132>[2012-04-04 13:30:43] EFW: IPSEC: prio=3 id=01802715 rev=1 event=event_on_ike_sa side=Responder msg="failed" int_severity=6

To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.