The application consists of the following components:

1. Dashboard Package
   
   • LP_BlueCoat SG
2. Normalization Package
   
   • LP_BlueCoat ProxySG 
   • LP_BlueCoat Audit
3. Compiled Normalizer
   • BlueCoatnFMAINNormalizer

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

Installation 

Follow these steps to install the BlueCoat v5.0.1 application:

1. Download the BlueCoat package from the Download section above.
2. Add the BlueCoat server as the required device in LogPoint.
3. Create a log collection policy with the Syslog collector and appropriate processing policy. 
4. Assign the policy to the device.
5. Add the dashboard.

Screenshots

Supported Log Formats

1. Format: bcreportermain_v1
   The fields in HTTP main logs:
   date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation. 
2. Format: bcreportermain_plus
   date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation s-supplier-ip
3. Format: bcreporterssl_v1
   The fields in HTTPS main logs:
   date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-rs-certificate-observed-errors x-cs-ocsp-error x-rs-ocsp-error x-rs-connection-negotiated-cipher-strength x-rs-certificate-hostname x-rs-certificate-hostname-category
4. Format: bcreporterssl_plus
   date time time-taken c-ip cs-username cs-auth-group x-exception-id sc-filter-result cs-categories sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-rs-certificate-observed-errors x-cs-ocsp-error x-rs-ocsp-error x-rs-connection-negotiated-cipher-strength x-rs-certificate-hostname x-rs-certificate-hostname-category s-supplier-ip
5. Format: Customized log format
   date time time-taken c-ip cs-username cs-auth-group s-supplier-name s-supplier-ip s-supplier-country s-supplier-failures x-exception-id sc-filter-result cs-categories cs(Referer) sc-status s-action cs-method rs(Content-Type) cs-uri-scheme cs-host cs-uri-port cs-uri-path cs-uri-query cs-uri-extension cs(User-Agent) s-ip sc-bytes cs-bytes x-virus-id x-bluecoat-application-name x-bluecoat-application-operation cs-threat-risk x-bluecoat-transaction-uuid x-icap-reqmod-header(X-ICAP-Metadata) x-icap-respmod-header(X-ICAP-Metadata)

Supported Version

The supported version of BlueCoat with LogPoint in this configuration is:

• Access Logs for BlueCoat SG/BlueCoat SG Proxy - SGOS 6.5.2.1 

To export data to LogPoint, use the Syslog collector on port 514 on the LogPoint server.