Ana içeriğe geç

Apinizer Syslog Integration

Frequently Asked Questions and Answers​

Question 1: How many main categories is the logging mechanism divided into in Apinizer?​

Logging in Apinizer is basically divided into two main categories:

  • Traffic Logs: Contains all API traffic information passing through Apinizer and is recorded to the Elasticsearch application by default.
  • System Logs (Audit & Application): Records operations and events related to the system. These are sent to the MongoDB database by default.

Question 2: What subcategories are System Logs divided into and which ones can be sent to external systems via Syslog?​

System Logs are divided into five subcategories. Four of them can be sent to an external product via Syslog, and their destinations are configured on the SIEM & Log Forwarding page under Administration → System Settings:

  • Audit Log (Operations on System): Logs related to changes and operations made in the Apinizer management application.
  • Token Log: Contains logs related to token acquisition when Apinizer is used as a token provider.
  • Application Log: Software logs of Apinizer applications/modules. It is kept at error (Error) level by default and users can change its level according to their needs.
  • Test Console Audit: Audit logs related to the use of the Test Console in the Apinizer management application interface. It is not sent to external syslog products.
  • Login Audit: Log records of sign-in, sign-out, token refresh and account-lock events on the Apinizer management application interface. They are forwarded as the Session stream on the SIEM & Log Forwarding page (Syslog included).

Question 3: Which payload format does a destination send?​

Each destination sends one of two formats:

  • Legacy Raw: today's output, unchanged and frozen. Every field an existing parser relies on is produced exactly as before; fields added to Apinizer in later versions do not appear in it.
  • Apinizer JSON v2: a canonical envelope shared by all four system log streams, with a stable field order, an explicit outcome, a severity value, and a curated data object from which token values, passwords and authentication headers are excluded by construction. The privacy profile and the event size limit apply only to this format.

New fields may be added to the v2 envelope without raising its schema version, so a parser must ignore fields it does not recognise. See SIEM & Log Forwarding for the envelope, the field list per stream and the filtering rules.

Question 4: What are the difficulties encountered when sending logs to a SIEM product like QRadar?​

In JSON format logs, the relevant parameters need to be parsed by writing a parser and stored in this way. Therefore, it is necessary to work together with people who manage/use the Apinizer product or are familiar with web services to determine the important fields for the organization together.

In some uses, the length of the log record that can be received at once can also be a problem. In such cases, when opening syslog integration, it can also be set to send only a certain number of characters of the body field.

Question 5: Do System Audit logs coming via Syslog meet User Audit logs? What differences are there between them?​

No, System Audit logs that can be sent via Syslog and the mentioned User Audit logs have different content:

  • System Audit Logs: "Who did what on which page" that is, general logs related to changes made on the system.
  • User Audit Logs: There is no separate "user audit" log in this definition externally. Generally, user-focused audits are handled under special category logs such as Login Audit and Test Console Usage Audits, and these are not currently sent to an external application.

Transfer of API Traffic and System Logs to Syslog and Log Templates​

First, Syslog connection settings must be made, you can check the Syslog Connection Management page for these connection settings.

You can visit the Transfer Traffic Logs to Syslog page for Apinizer traffic log transfer to syslog settings.

You can visit the Transfer System Logs to Syslog page for Apinizer system log transfer to syslog settings.

You can visit the SIEM & Log Forwarding page for destinations, per-stream filtering rules, payload profiles, the privacy profile and the event size policy.

En son tarihinde güncellendi