Logo
Sign in
  1. Logpoint Service Desk
  2. Products Hub
  3. Marketplace

IBoss

Avatar Permanently deleted user
December 11, 2024 08:51
Follow
iboss.png

General Description

The IBoss application normalizes IBoss events. You can further customize the searches to perform in-depth analysis.

For LogPoint v6.7.0 or later For LogPoint v6.0.0 to v6.6.6

Release Details

Fields

Details

Name

IBoss

Version

5.0.1

Supported On

LogPoint v6.7.0 and later

Release Date

2020-05-14

Document Date

2020-05-14

Download

 IBoss_5.0.1.pak

SHA256

 4255c5258eb5703bde2fe8c7a4b6e15fc848b6f4beb96983f9bf84afa108dcf0

 

Package Details

The application consists of the following components:

  1. Normalization Package
    • LP_iBoss URL Filtering Appliance 
  2. Compiled Normalizer
    • IBossCompiledNormalizer

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

Installation 

Follow these steps to install the IBoss v5.0.1 application:

  1. Download the IBoss package from the Download section above.
  2. Add IBoss as the required device in LogPoint.
  3. Create a collection policy with the Syslog collector and appropriate processing policy. 
  4. Assign the policy to the device.
  5. Add the dashboard.

Supported Device

The supported device of IBoss with LogPoint in this configuration is:

  • iBoss URL Filtering Appliance

Log Format

Expected Log Format

Key = Value pair separated by a delimiter

Log Samples

<14>Jan 24 10:03:45 abc.com Wed Jan 24 10:02:42 GMT 2018,URL_LOG_ENTRY,URL_LOG_ID=3374206,BYTES=0,CONTENT_TYPE=1,ACTION=Allowed,URL=t0.ssl.dk.mno.pqrs.abc.net,CATEGORIES=20,IPADDR=88.88.88.88,COMP_MAC=00:00:00:00:00:00,COMP_NAME=EMPTY,LOC=EMPTY,SRC_IPADDR=10.10.10.10,CALLOUT=0,REPORT_GROUP=0,STATUS=0,STEALTH=0,QOS_EVENT=0,AUDIT=0,IBOSS=iboss1,MALWARE=0,CNC_FLAG=0,AVSCANNED=0,CATEGORIES_NAMES=Travel,REQUEST_METHOD=aaa,USER_AGENT=aa,

URL_LOG_ENTRY URL_LOG_ID=2987356 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=https://www.xyz.com

URL_LOG_ENTRY URL_LOG_ID=4074292 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=xyz.com CATEGORIES=35,36,39 IPADDR=1.1.1.1 COMP_MAC=00:00:00:00:00:00 COMP_NAME=WCE-ACCT-01 LOC=EMPTY SRC_IPADDR=1.1.1.2 CALLOUT=0 REPORT_GROUP=0 STATUS=0 STEALTH=0 QOS_EVENT=0 AUDIT=0 IBOSS=iboss1 MALWARE=0 CNC_FLAG=0 AVSCANNED=0 CATEGORIES_NAMES=Business,Web Hosting,Technology

To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.

Release Details

Fields

Details

Name

IBoss

Version

3.2.0

Supported On

LogPoint v6.0.0 to v.6.6.6

Release Date

2020-05-14

Document Date

2020-05-14

Download

 IBoss_3.2.0.pak

SHA256

 b48a6f181be954308717eca277f03ae7b431c88a27937d97094e57001028c3f9

 

Package Details

The application consist of the following components:

  1. Normalization Package
    • LP_iBoss URL Filtering Appliance 
  2. Compiled Normalizer
    • IBossCompiledNormalizer

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

Installation 

Follow these steps to install the IBoss v3.2.0 application:

  1. Download the IBoss package from the Download section above.
  2. Add IBoss as the required device in LogPoint.
  3. Create a collection policy with the Syslog collector and appropriate processing policy. 
  4. Assign the policy to the device.
  5. Add the dashboard.

Supported Device

The supported device of IBoss with LogPoint in this configuration is:

  • iBoss URL Filtering Appliance

Log Format

Expected Log Format

Key = Value pair separated by a delimiter

Log Samples

<14>Jan 24 10:03:45 abc.com Wed Jan 24 10:02:42 GMT 2018,URL_LOG_ENTRY,URL_LOG_ID=3374206,BYTES=0,CONTENT_TYPE=1,ACTION=Allowed,URL=https://abc.com,CATEGORIES=20,IPADDR=88.88.88.88,COMP_MAC=00:00:00:00:00:00,COMP_NAME=EMPTY,LOC=EMPTY,SRC_IPADDR=10.10.10.10,CALLOUT=0,REPORT_GROUP=0,STATUS=0,STEALTH=0,QOS_EVENT=0,AUDIT=0,IBOSS=iboss1,MALWARE=0,CNC_FLAG=0,AVSCANNED=0,CATEGORIES_NAMES=Travel,REQUEST_METHOD=aaa,USER_AGENT=aa,

URL_LOG_ENTRY URL_LOG_ID=2987356 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=https://www.xyz.com

URL_LOG_ENTRY URL_LOG_ID=4074292 BYTES=0 CONTENT_TYPE=1 ACTION=Allowed URL=xyz.com CATEGORIES=35,36,39 IPADDR=1.1.1.1 COMP_MAC=00:00:00:00:00:00 COMP_NAME=WCE-ACCT-01 LOC=EMPTY SRC_IPADDR=1.1.1.2 CALLOUT=0 REPORT_GROUP=0 STATUS=0 STEALTH=0 QOS_EVENT=0 AUDIT=0 IBOSS=iboss1 MALWARE=0 CNC_FLAG=0 AVSCANNED=0 CATEGORIES_NAMES=Business,Web Hosting,Technology

To export data to LogPoint, use Syslog collector on port 514 on the LogPoint server.

 

Support

If you have any queries or require assistance, please feel free to contact our support team: 

Email: servicedesk@logpoint.com
Phone: +45 7060 6100

Best regards,
untitled.svg

Comments

Article is closed for comments.

Related articles

  • Incapsula
  • PRTG Network Monitor
  • SentinelOne
  • LP672 Plugin Upgrade Helper
  • OpenDJ
Was this article helpful?
0 out of 0 found this helpful
Privacy policy    EULA    Terms of service   
Copyright © , Logpoint. All rights reserved.

Note: We use cookies that are essential for the smooth functioning of our website.