Enabling Audit Data Export - BlueCat Address Manager - 9.4.0

Address Manager Administration Guide

Locale
English (United States)
Product name
BlueCat Address Manager
Version
9.4.0

The following section outlines the steps to enable Audit Data Export. If you are configuring to export audit data to a Splunk™ server, ensure that you have the Splunk HTTP Event Collector (HEC) host and token information. For details on configuring HTTP Event Collector on Splunk, refer to the Splunk documentation.

To enable audit data export:

  1. Select the Administration tab. Tabs remember the page you last worked on, so select the tab again to ensure you're on the Administration page.
  2. Under Data Management, click Audit Data Settings.
  3. Click Audit Data Export.
  4. Under General, set the following parameters:
    • Enable Audit Data Export—select this check box to enable the Audit Data Export feature.
    • Log Destination—select where the audit data will be exported. You can select HTTP to export data to an HTTP endpoint or Splunk to export data to a Splunk server.
      If you select Splunk, the following fields appear:
      • Host—enter the URI of the Splunk HEC host. The standard format of the HEC URI in Splunk Enterprise is as follows:
        <protocol>://<FQDN of the host only>:<port>
        Note: Ensure that the HEC URI format is followed exactly as described above without adding or omitting any pieces. The port is required, even if default. Do not include extra slashes or folders in the URI.
      • Token—enter the Splunk HEC token.
      • Healthcheck—select this check box to enable health check service; deselect this check box to disable health check service.
      If you select HTTP, the following fields appear:
      • Output URI—enter the URI of the HTTP endpoint.
      • Healthcheck—select this check box to enable health check service; deselect this check box to disable health check service.
      • Healthcheck URI—enter the URI of the HTTP endpoint that will be consuming the health check information.
    • TLS Options—select this check box to configure TLS options.
      Attention: If you enter an HTTPS endpoint in the Output URI or Healthcheck URI field when configuring HTTP output, or Host field when configuring Splunk output, you must select this check box and enter TLS information.
      • Under CA Certificate Upload, click Browse and locate the CA certificate used to verify server certificate during TLS handshake.
        Note: The file must be in PEM format. Though the certificate may not be required in other contexts, it is required for the configuration of this feature. The CA certificate can be acquired via export from a browser or other trusted source, and converted to PEM format.
      • Click Upload to upload the CA certificate.
      • Select the Verify Certificate check box to force verification of the server certificate during the TLS handshake using the CA certificate that was entered.
      • Select the Verify Hostname check box to validate the hostname part of the URI against the CN (Common Name) or SAN (Subject Alternative Name) of the server certificate during the TLS handshake.
  5. Click Update.
Once you have enabled audit data export, selected the log destination as Splunk, and generated some session and event logs in BAM, log in to the Splunk server to view the detailed event information.
Note: The BAM UI completes before fully connecting to the SIEM solution. So, users should validate that the export is working by monitoring the event logs in BAM for any failures. It is recommended to set up a monitoring service to get SNMP or receive emails for events.
Attention:
  • Suppose the service is enabled but not working. In that case, it will consume additional disk space to hold the audit data in the BAM database until it is exported successfully to an external database.
  • When replicating the database for disaster recovery, ensure that the audit data export service is enabled on all BAMs before configuring replication. Enabling the audit data export service on all the BAMs ensures that the audit data export service and its settings are present on all the BAMs in replication, allowing failover to work. This will also ensure that failover does not result in the loss of audit data.
  • If you have enabled database replication prior to configuring audit data export, contact BlueCat Customer Care for assistance with configuring audit data export in an existing replication environment.
  • The audit data export service stores event data in a buffer before it is exported to the HTTP or Splunk endpoint. In the event that the service fails to export data to the endpoint, there may be a loss of event data.