Using NXLog to Ship Data

Anomali Security Analytics can ingest event log data from NXLog when it is routed through AWS Simple Storage Service (S3). Anomali provides the S3 bucket. Your organization must configure NXLog to send logs to it. Multiple network devices from your organization can feed into a single S3 bucket.

Before You Begin

• Your organization must have a dedicated AWS S3 bucket provided by Anomali. Contact Anomali Customer Support to request an S3 bucket. Anomali will provide you access key and secret key once your S3 bucket is set up.

• Your organization must have an enterprise license for NXLog. Contact Anomali Customer Support to request the license.

• Your organization must have virtual machines (VMs). The number of VMs depends on the volume of logs you need to ingest. If you have huge log volumes, Anomali recommends the following minimal requirements for each VM:

  • Linux-based OS

  • 4 core CPU

  • 8–16 GB of RAM

Step 1. Set Up NXLog Enterprise Edition Agent

Install an NXLog Enterprise Edition agent. For more information on how to install an NXLog Enterprise Edition agent, see https://docs.nxlog.co/refman/current/index.html.

Step 2. Deploy NXLog Agent

Deploy the NXLog agent. For more information on how to deploy the NXLog agent, see https://docs.nxlog.co/userguide/deploy/index.html.

Step 3. Prepare Configuration File

1. Create a configuration file based on your requirements and the OS that you use. For more information of the configuration file structure, see https://docs.nxlog.co/userguide/configure/overview.html.

2. In the Input section of your configuration file, specify the information about the input modules for sources of your logs:

   <Input udp>

   	Module        im_udp

   	ListenAddr    IP::port

   	BatchSize     3000

   	BatchFlushInterval 300

   </Input>

3. In the Output section of your configuration file, specify the information about log destination, which is the S3 bucket provided by Anomali:

   <Output s3>

   	Module       om_amazons3

   	Region       us-east-1

   	Bucket       bucket name

   	Server       name of technology

   	AccessKey    your Anomali-provided access key

   	SecretKey    your Anomali-provided secret key

   </Output>

   For more information on AWS S3 configuration, see https://docs.nxlog.co/refman/current/om/amazons3.html.

4. In the Route section of your configuration file, specify the name of your input module and S3 output in the path:

   <Route udp_aws_s3>

   	Path          udp => s3

   </Route>

5. Verify whether your configuration is correct. For this, see https://docs.nxlog.co/refman/current/man-nxlog.html.