Artica Proxy

Package Details

The application consist of the following components:

1. Normalization Package
   • LP_Artica Proxy

General Description

The Artica Proxy application normalizes Artica Proxy events and enables you to analyze Artica Proxy data. You can further customize the searches to perform an in-depth analysis.

Installation 

Follow these steps to install the Artica Proxy v5.0.0 application:

1. Download the Artica Proxy package from the Download section above.
2. Add the required Artica Proxy server as a device in LogPoint.
3. Create a collection policy with the Syslog collector and an appropriate processing policy.  
4. Assign the policy to the device.

Supported Device

The device supported by the Artica Proxy with LogPoint in this configuration is:

• Artica Proxy version 3.x

Log Formats

Atrica Proxy

Expected Log Format

Common Log Format

Log Sample

remotehost rfc931 authuser [date] "request" status bytes

Expected Log Format

Key : Value

Log Sample

<182>May 18 16:14:38 CGLPROXY02 (squid-1): [Proxy-Connection: keep-alive\r\nUser-Agent: xxxxxxx/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/xxx.xx (KHTML, like xxxxx) Chrome/xx.x.xxxx.xx Safari/xxx.xx\r\nX-Forwarded-For: xxx.xx.xx.xxx\r\nHost: abc.com:xxx\r\n] [HTTP/1.1 407 Proxy Authentication Required\r\nServer: squid\r\nMime-Version: 1.0\r\nDate: Mon, 18 May 2020 14:14:38 GMT\r\nContent-Type: text/html;charset=utf-8\r\nContent-Length: XXXXX\r\nX-Squid-Error: ERR_CACHE_ACCESS_DENIED 0\r\n\r]

To export data to LogPoint, use the Syslog collector on port 514 of the LogPoint server.