General Description
The IBoss application normalizes IBoss events. You can further customize the searches to perform in-depth analysis.
Release Details
Fields |
Details |
---|---|
Name |
IBoss |
Version |
5.0.1 |
Supported On |
LogPoint v6.7.0 and later |
Release Date |
2020-05-14 |
Document Date |
2020-05-14 |
Download | |
SHA256 |
4255c5258eb5703bde2fe8c7a4b6e15fc848b6f4beb96983f9bf84afa108dcf0 |
Package Details
The application consists of the following components:
- Normalization Package
- LP_iBoss URL Filtering Appliance
- Compiled Normalizer
- IBossCompiledNormalizer
Enhancement
A minor update has been done in the application’s normalizer for better signature handling.
Installation
Follow these steps to install the IBoss v5.0.1 application:
- Download the IBoss package from the Download section above.
- Add IBoss as the required device in LogPoint.
- Create a collection policy with the Syslog collector and appropriate processing policy.
- Assign the policy to the device.
- Add the dashboard.
Supported Device
The supported device of IBoss with LogPoint in this configuration is:
- iBoss URL Filtering Appliance
Log Format
Expected Log Format
Key = Value pair separated by a delimiter
Log Samples
<14>Jan 24 10:03:45 abc.com Wed Jan 24 10:02:42 GMT 2018,URL_LOG_ENTRY,URL_LOG_ID=3374206,BYTES=0,CONTENT_TYPE=1,ACTION=Allowed,URL=t0.ssl.dk.mno.pqrs.abc.net,CATEGORIES=20,IPADDR=88.88.88.88,COMP_MAC=00:00:00:00:00:00,COMP_NAME=EMPTY,LOC=EMPTY,SRC_IPADDR=10.10.10.10,CALLOUT=0,REPORT_GROUP=0,STATUS=0,STEALTH=0,QOS_EVENT=0,AUDIT=0,IBOSS=iboss1,MALWARE=0,CNC_FLAG=0,AVSCANNED=0,CATEGORIES_NAMES=Travel,REQUEST_METHOD=aaa,USER_AGENT=aa,
URL_LOG_ENTRY URL_LOG_ID=2987356 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=https://www.xyz.com
URL_LOG_ENTRY URL_LOG_ID=4074292 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=xyz.com CATEGORIES=35,36,39 IPADDR=1.1.1.1 COMP_MAC=00:00:00:00:00:00 COMP_NAME=WCE-ACCT-01 LOC=EMPTY SRC_IPADDR=1.1.1.2 CALLOUT=0 REPORT_GROUP=0 STATUS=0 STEALTH=0 QOS_EVENT=0 AUDIT=0 IBOSS=iboss1 MALWARE=0 CNC_FLAG=0 AVSCANNED=0 CATEGORIES_NAMES=Business,Web Hosting,Technology
To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.
Release Details
Fields |
Details |
---|---|
Name |
IBoss |
Version |
3.2.0 |
Supported On |
LogPoint v6.0.0 to v.6.6.6 |
Release Date |
2020-05-14 |
Document Date |
2020-05-14 |
Download | |
SHA256 |
b48a6f181be954308717eca277f03ae7b431c88a27937d97094e57001028c3f9 |
Package Details
The application consist of the following components:
- Normalization Package
- LP_iBoss URL Filtering Appliance
- Compiled Normalizer
- IBossCompiledNormalizer
Enhancement
A minor update has been done in the application’s normalizer for better signature handling.
Installation
Follow these steps to install the IBoss v3.2.0 application:
- Download the IBoss package from the Download section above.
- Add IBoss as the required device in LogPoint.
- Create a collection policy with the Syslog collector and appropriate processing policy.
- Assign the policy to the device.
- Add the dashboard.
Supported Device
The supported device of IBoss with LogPoint in this configuration is:
- iBoss URL Filtering Appliance
Log Format
Expected Log Format
Key = Value pair separated by a delimiter
Log Samples
<14>Jan 24 10:03:45 abc.com Wed Jan 24 10:02:42 GMT 2018,URL_LOG_ENTRY,URL_LOG_ID=3374206,BYTES=0,CONTENT_TYPE=1,ACTION=Allowed,URL=https://abc.com,CATEGORIES=20,IPADDR=88.88.88.88,COMP_MAC=00:00:00:00:00:00,COMP_NAME=EMPTY,LOC=EMPTY,SRC_IPADDR=10.10.10.10,CALLOUT=0,REPORT_GROUP=0,STATUS=0,STEALTH=0,QOS_EVENT=0,AUDIT=0,IBOSS=iboss1,MALWARE=0,CNC_FLAG=0,AVSCANNED=0,CATEGORIES_NAMES=Travel,REQUEST_METHOD=aaa,USER_AGENT=aa,
URL_LOG_ENTRY URL_LOG_ID=2987356 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=https://www.xyz.com
URL_LOG_ENTRY URL_LOG_ID=4074292 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=xyz.com CATEGORIES=35,36,39 IPADDR=1.1.1.1 COMP_MAC=00:00:00:00:00:00 COMP_NAME=WCE-ACCT-01 LOC=EMPTY SRC_IPADDR=1.1.1.2 CALLOUT=0 REPORT_GROUP=0 STATUS=0 STEALTH=0 QOS_EVENT=0 AUDIT=0 IBOSS=iboss1 MALWARE=0 CNC_FLAG=0 AVSCANNED=0 CATEGORIES_NAMES=Business,Web Hosting,Technology
To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.
Support
If you have any queries or require assistance, please feel free to contact our support team:
Email: servicedesk@logpoint.com
Phone: +45 7060 6100
Best regards,
Comments
Article is closed for comments.